ARTICLE
17 January 2025

Data Brokers Must Provide Full 2023 Metrics In CPPA Registrations

KD
Kelley Drye & Warren LLP

Contributor

Kelley Drye & Warren LLP is an AmLaw 200, Chambers ranked, full-service law firm of more than 350 attorneys and other professionals. For more than 180 years, Kelley Drye has provided legal counsel carefully connected to our client’s business strategies and has measured success by the real value we create.
Data brokers who are registering with the California Privacy Protection Agency (CPPA) this month should prepare to provide full metrics about their responses to privacy rights in calendar year 2023.
United States California Privacy

Data brokers who are registering with the California Privacy Protection Agency (CPPA) this month should prepare to provide full metrics about their responses to privacy rights in calendar year 2023.

Specifically, the CPPA's 2025 registration form requires data brokers to provide their mean and median response times to requests in 2023 under the CCPA to access, delete, or correct personal information, opt-out of the sale or sharing of personal information to third parties, or to access, or limit the use or disclosure of sensitive personal information, as set forth in California Civil Code § 1798.99.85(a)(1)-(2). In addition, data brokers will be required to report the number of requests they completed or denied (including partial denials). (Note: The registration form does not show these requests for statistics until the registrant completes the first page of the form.)

The CPPA did not require data brokers to report these statistics in their 2024 registrations, and the 2025 registration form was not part of the rulemaking package that was made effective on an expedited basis. The CPPA's current registration form, however, states that data brokers were required under the Delete Act to disclose these statistics in their privacy policies by July 1, 2024, suggesting that adding them to the CPPA's current registration form should not involve any additional burden.

The 2025 registration period ends on January 31, 2025. Data brokers that register after January 31 face fines of $200 per day. Late registrations were the subject of the CPPA's first four formally resolved enforcement actions.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More