The California Privacy Protection Agency (CPPA) and Background Alert, Inc. (a California-based data broker) settled allegations that Background Alert failed to register and pay the annual fee required by the California Delete Act. This settlement is part of the CPPA’s investigative initiative announced back in October 2024.

The Delete Act requires data brokers to register with the CPPA and pay an annual fee to fund the California Data Broker Registry. Data brokers can face fines of $200 per day for failing to register by the deadline. The CPPA alleged that Background Alert failed to register between February 1 and October 8, 2024.

The California Consumer Privacy Act (CCPA) defines a “data broker” as a business that collects and sells personal information about consumers with whom they do not have a direct relationship or any direct interaction with those consumers. Data brokers act as intermediaries in the data market by acquiring information from other sources and then selling it to third parties. 

As a result of this failure, Background Alert is required to shut down its business from now until 2028 or it could be subject to a $50,000 fine.

The CPPA alleged that Background Alert created consumer profiles and sold those profiles through its website, backgroundalert.com. According to the settlement agreement, Background Alert analyzed and summarized billions of public records and then drew inferences from those records to identify consumers who “may somehow be associated with” a searched-for individual and identified patterns to generate profiles about consumers. Background Alert actually promoted its business by claiming: “It’s scary how much information you can dig up on someone.”

CPPA’s Head of Enforcement, Michael Macko, warned other businesses that California residents have certain rights and protections over their personal information, including the creation of profiles using inferences about consumers; “[i]f that’s your business, then you have responsibilities under California’s comprehensive privacy law, the CCPA and you might also qualify as a data broker under the Delete Act. [This] action shows that [the CPPA] won’t hesitate to pursue violations based on inferences and profiling.” If your company hasn’t assessed whether it’s a data broker under the CCPA or registered its business in accordance with the Delete Act, the time is now. If the Delete Act does apply, your business must register with the CPPA, pay the annual fee, disclose detailed information about its data collection practices, provide a mechanism for consumers to request deletion of their personal data, process deletion requests within a specified timeframe, and undergo periodic independent audits.