CalPrivacy and Attorney General actions, broken down by what regulators cited and what it means for a live website.
6 articles, newest first
Governor Newsom signed SB 690 on September 30, 2026. From January 1, 2027, CIPA section 638.51 pen register claims over website and app tracking belong to the Attorney General alone. Section 631 wiretapping claims keep their private right of action.
In early September CalPrivacy fined a B2B contact-data company $36,400 for never registering as a data broker, then its Enforcement Division issued an advisory warning that a registry filing carrying wrong information can draw $200 a day. Both moves point straight at adtech and lead-gen companies that don't think of themselves as brokers.
Updated
In a single week, CalPrivacy fined two out-of-state data brokers a combined $168,890 — LocateSmarter $116,490 in the Agency's first action under both the CCPA and the Delete Act, Cybba $52,400 for never registering. The data-minimization holding reaches far beyond brokers. Here's what changed and who's exposed.
As of August 1, 2026, one request on California's DROP platform reaches every registered data broker at once, on a 45-day clock backed by $200-a-day fines. Plenty of businesses qualify as brokers without realizing it. Here's what changed and how to check.
Updated
CalPrivacy just launched its first industry-wide CCPA audit, and it's aimed at gig economy apps. The focus is access rights: whether people can actually see the data collected on them. Here's what it means for every business.
California's largest CCPA penalty at the time hit Disney for incomplete opt-outs, ad-tech data sharing, and ignoring the GPC signal. Here's what went wrong and how Privisy would have caught it.
Updated
The provisions these articles turn on, with the text and a plain-language summary of each.
Put it to work
The free check sends a real GPC signal to one URL and shows whether marketing trackers stop. The full audit runs free from our homepage with no account; paying unlocks its evidence.