Failure to register as data broker; consumer profiling
Delete Act registration enforcement action brought as part of CPPA’s Data Broker Enforcement Strike Force. ROR Partners, a Nevada-based marketing firm serving fitness and wellness brands, operated in 2024 without registering with the California Data Broker Registry despite using “billions of data points” to build detailed consumer profiles and custom audience segments covering more than 262 million Americans. The company drew behavioral and demographic inferences from this data, identifying frequent gym-goers and selling them as a targetable fitness segment to health clubs, then sold the resulting profiles for targeted advertising.
The board’s decision establishes that marketing and advertising firms qualify as data brokers when they collect and sell personal information regardless of whether it is bundled into a broader product or service offering. The decision quotes: “A sale is a sale. A business cannot bypass the CCPA’s and the Delete Act’s requirements by selling personal information as part of a larger suite of products and services it offers.”