CalPrivacy Drops Latest DROP Enforcement Advisory: FAQs And Another Clear Warning To Data Brokers

On December 17, 2025, CalPrivacy, California's privacy enforcement agency, issued Enforcement Advisory No. 2025-01 to provide guidance on data broker registration. The Advisory focuses on requirements related to trade names, websites, and parent or subsidiary relationships, with the overall theme registering a warning to companies not to try to game the Data Broker Registry or the Delete Request and Opt-out Platform (DROP) system.

The Advisory emphasizes that companies must register by January 31, 2026, and establish a DROP account if they were operating as data brokers for any period of time in the prior year (i.e., 2025). This should come as no surprise to the data broker industry, as California (and other) regulators have been clear about their intentions to increase oversight and focus enforcement on non-compliance in the data broker industry. Companies should assess whether they qualify as a "data broker," as companies may fall within scope based on various