California’s Privacy Protection Agency (CalPrivacy) has taken enforcement action against a data broker—Rickenbacher Data LLC (doing business as Datamasters)—that sold sensitive health and personal information about millions of people without proper registration under California law.

• The company marketed lists of people with serious health conditions (e.g., Alzheimer’s disease, drug addiction, other medical conditions) and other demographic data for targeted advertising.
• Because the firm was not registered as a data broker as required by California’s Delete Act, the agency ordered it to stop selling all personal information of Californians and imposed a fine (e.g., ~$45,000).

This effectively bans the resale of that health data in California and removes the company from the marketplace for such information.

Why this matters

• Health data and other sensitive personal information are considered especially risky because they can be exploited for intrusive targeted advertising, profiling, or even discrimination.
• This enforcement sends a strong message that data brokers must comply with registration and privacy laws or face action.

Background: California’s Delete Act & Data Broker Rules

California passed the Delete Act (SB-362) to give residents more control over their personal data and require data brokers to register and honor deletion requests.

• Under the law, data brokers must register with CalPrivacy and, starting in 2026, respond to consumers’ deletion requests via the state’s Delete Request and Opt-out Platform (DROP).
• Brokers that fail to register or comply with the law can be fined and prohibited from selling personal information, as in this recent case.

Timeline

• January 1, 2026: DROP (deletion request platform) officially launched for California residents.
• January 8–11, 2026: CalPrivacy announces enforcement actions, including the Datamasters ban and fines.
• August 1, 2026: Data brokers are required to begin processing deletion requests submitted through DROP.

What this means for people

If you’re a California resident:

• You can use the DROP platform to request deletion of your personal data from registered brokers.
• Data brokers violating the law (like selling unregistered health data) can be stopped and fined.

If you’re elsewhere:

• This action reflects a growing trend in data privacy enforcement—especially around sensitive categories like health information—even absent a national law.