For the first time in history, the California Privacy Protection Agency (CPPA) has ordered a data broker to cease operations for failing to comply with legal requirements. The company Background Alert has agreed to shut down its business for three years after failing to adhere to the Delete Act, which mandates that such brokers register with the state of California.
Background Alert amassed billions of public records to create and sell user profiles on its website, analyzing data and drawing associative connections between individuals who “may be linked” to a specific person. The CPPA took particular issue with the company’s aggressive marketing, which proclaimed, “It’s terrifying how much information you can find on someone.” The agency also criticized promotional materials referencing the detection of ‘alarming patterns,’ arguing that such practices infringe upon individuals’ privacy rights.
The CPPA cautioned that even seemingly harmless data, when combined with other sources, can be used to infer personal characteristics, leading to profiling that poses a heightened risk to migrants, veterans, and patients at reproductive health clinics.
California has been actively cracking down on illicit data brokerage practices. Under the Delete Act, companies are required to register annually and pay a fee, which funds the development of a tool that enables users to erase their data from all registered brokers with a single click.
In October 2024, California became the second U.S. state to formally recognize the protection of mental privacy at the legislative level. On September 28, a new law was enacted, amending the existing Consumer Privacy Protection Act to incorporate the concept of neurodata, significantly expanding citizens’ rights to control information related to their brain activity.
