More CA Delete Act Enforcement; Exec Order to Require Alignment with FTC

Want to receive these privacy recaps in your inbox each week? Subscribe here.

USA

Another Unregistered Data Broker Hit with a Delete Act Action

The California Privacy Protection Agency (CPPA) brought its sixth enforcement action against an alleged data broker that had failed to register under the Delete Act, this time seeking a $46,000 fine against Florida-based background-check company Jerico Pictures d/b/a National Public Data, which closed its doors following a 2024 security incident. The first five actions since the January 2024 registration deadline under the Delete Act have all been settled. 

TAKEAWAY

The six actions are part of a broader investigative sweep of data broker registration compliance announced on October 30, 2024. Data Brokers that register under the Delete Act are required to pay an annual fee, disclose certain information about its activities, process consumer deletion requests submitted to a central mechanism maintained by the CPPA beginning in August 2026, and be subject to independent audits every three years. Although settlements have been low so far compared to the likely cost of complying, potential fines, which can amount to up to $200 per day of failing to register under the law, will increase as time goes by. 

Executive Order Will Require FTC Alignment with President Policies

President Trump signed an Executive Order February 18, 2025 titled “Ensuring Accountability for all Agencies” that requires independent regulatory agencies, including the FTC, to be subject to review and adjustment  by the Office and Management and Budget (OMB) “for consistency with the President’s policies and priorities”, regular consultation with the White House Domestic Policy Council and the White House National Economic Council, and clearance of strategic plans by the OMB, among other obligations.

TAKEAWAY

The application of this Executive Order to the FTC has raised alarms for some privacy advocates, including, for example, the Electronic Privacy Information Center, which issued a statement saying the order “endangers the bipartisan work” of the FTC and the FCC and cautioning that “routine FTC and FCC functions like enforcing data security and privacy protections, investigating businesses engaged in harmful data practices, and adopting rules to implement acts of Congress may be converted into political weapons.”

The FTC is made up of five commissioners, no more than three of which, by law, can be from the same political party. This, in combination with the commission’s “independent agency” status has historically meant that the strategies of the FTC have not necessarily aligned with the politics of the then-current administration.

Although Democratic commissioners have had the majority since 2022, that majority was lost with the recent departure of Lina Khan, so the FTC priorities we have seen in the last couple of years may have shifted with the new FTC makeup anyway, even without this Executive Order. However, the Executive Order may have longer-term implications for the general bipartisan balance built into the structure of the agency. 

Want more of the privacy highlights that matter for consent management and digital marketing? Sign up for our privacy newsletter, A Little Privacy, Please.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.