Failure to register as data broker
This administrative action targeted National Public Data’s failure to register with the California Data Broker Registry under the Delete Act. The company, which made headlines after a 2024 breach reportedly exposed 2.9 billion records including Social Security numbers, registered 230 days late on September 18, 2024, and only after the Enforcement Division had contacted it during an investigation. The $46,000 fine represents the maximum penalty available under the Delete Act for registration failure.
CPPA obtained a default order after National Public Data failed to appear and contest the allegations. The case is notable for its default posture and for CPPA’s decision to pursue maximum penalties, signaling that cooperation is expected but not guaranteed to reduce exposure.