Observed Signal · Jun 16, 2026 · Regulation · Source: AdExchanger · Impact: 4/5 · Sentiment: Negative
CalPrivacy Warns Ad Tech on California Broker Rules
Tom Kemp, executive director of CalPrivacy (the California Privacy Protection Agency), told AdExchanger that ad tech companies should re‑examine whether they qualify as "data brokers" under California law. The article explains the DELETE Act — California’s new data broker law — which establishes a statewide broker registry and a CPPA-run portal called DROP (Delete Request and Opt-Out Platform) that lets residents submit bulk deletion and opt-out requests to registered brokers. Kemp says more than 300,000 Californians have signed up for DROP. The piece warns that companies that collect, aggregate and sell personal information about people with whom they have no direct relationship likely meet the statutory definition of a data broker, with implications for onboarders, ID vendors, audience-extension platforms and other intermediaries. It also flags enforcement trends around dark patterns, data minimization, and rules for automated decision‑making technology.
State-level regulatory changes (DELETE Act and CPPA tools) create a broker registry and bulk deletion portal that materially affect identity, data-brokers and many ad‑tech intermediaries; clarifies enforcement priorities for the industry.
Track Access Intelligence Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- CalPrivacy is the common name for the California Privacy Protection Agency (CPPA), established under the California Privacy Rights Act in 2020.
- The DELETE Act creates a statewide data broker registry and a CPPA portal called DROP (Delete Request and Opt-Out Platform).
- More than 300,000 California residents have signed up for DROP, per Tom Kemp.
- Under California law, entities that collect, aggregate and sell personal information about people they have no direct relationship with can meet the legal definition of a data broker.
- CPPA is issuing regulations and enforcement actions related to dark patterns, data minimization, and automated decision‑making technology.
Connected Companies & Entities
1 Entity mappedOntology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
California Delete Act and DROP Raise Broker Risk
AdExchanger reports that new U.S. privacy rules and enforcement are placing a renewed regulatory spotlight on companies that collect and sell consumer data. California’s Delete Act takes effect August 1 and introduces DROP, a centralized Delete Request and Opt‑Out Platform that allows residents to send one deletion request to all registered data brokers. Registered brokers must check DROP at least every 45 days and comply with deletion requests within 90 days; failures can trigger fines of $200 per request per day. Connecticut’s SB 4 (effective October 1 if signed) creates a separate data‑broker registry and defines “brokered personal data,” potentially sweeping in firms that buy, organize and resell third‑party information. Industry counsel warn companies cannot rely on informal self‑assessments (“I don’t think I’m a data broker”) and should reassess practices to avoid significant enforcement risk from CalPrivacy and state regulators.
California Simplifies Privacy: No More Legal Jargon!
Privacy policy developments in California continue to evolve as regulators push for easier consumer rights. The article discusses the so-called privacy paradox and argues opt-out processes should be straightforward rather than buried in legal jargon. Tom Kemp was appointed executive director of the California Privacy Protection Agency (CalPrivacy) in March 2025, succeeding Ashkan Soltani who left in January. CalPrivacy previously issued enforcement advisories on dark patterns and highlighted penalties under the California Consumer Privacy Act. Notable fines cited include Healthline's $1.55 million penalty in July 2025 for deceptive consent banners and failing to honor opt-outs, and Tractor Supply's $1.35 million penalty in September 2025 for similar infractions. The Delete Act created the Delete Request and Opt-Out Platform (DROP), launching January 1, 2026, with data brokers required to check the platform every 45 days starting August 1, 2026 to process deletion requests at scale.
Regulators Clarify Privacy Expectations for Ad Tech
U.S. federal and state privacy regulators and California’s new privacy agency urged clearer, consumer-friendly privacy practices for the ad tech industry at the IAB Public Policy & Legal Summit. Speakers emphasized protecting children, honoring opt-outs (including the Global Privacy Control), aligning practices with privacy policies, minimizing collected data, and ensuring easy exercise of consumer rights. California’s CPPA has created an Audits Division and hired Sabrina Ross as chief privacy auditor to run technical, in-the-wild tests of preference signals. Regulators cited recent California enforcement actions tied to opt-out failures (Disney, Healthline, Tractor Supply, Jam City) and noted the FTC’s OkCupid/Match settlement requires a decade of reporting and monitoring. Officials warned companies cannot plausibly claim ignorance about minor users when products and targeting indicate otherwise, and highlighted inconsistent state standards for data minimization as a compliance challenge.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.