California privacy regulator fines datamasters, bars firm from selling Californians’ data

The California Privacy Protection Agency has fined a Texas-based marketing firm $45,000 and barred it from selling Californians’ personal information after determining the company unlawfully bought and resold sensitive health and demographic data without registering as a data broker, state officials said.

The enforcement action targets Rickenbacher Data LLC, which operates as Datamasters, a marketing and data brokerage firm. The agency found that Datamasters failed to register its data brokerage activities as required under the California Delete Act, which mandates annual registration by Jan. 31 for businesses that buy or sell consumer information.

Beginning in 2026, the law will allow consumers to use a centralized online system known as the Delete Request and Opt-out Platform, or DROP, to submit deletion requests to all registered data brokers. Registration is a prerequisite for participation in that system.

State regulators determined that Datamasters continued operating as an unregistered data broker despite repeated efforts to bring the company into compliance. As a result of the violations, the firm has been prohibited from selling personal information belonging to Californians.

The agency’s final order states that Datamasters purchased and resold data tied to millions of individuals, including people identified as having medical conditions such as Alzheimer’s disease, drug addiction, and bladder incontinence, for targeted advertising purposes. The company also traded lists categorized by age and perceived race, including so-called senior and Hispanic lists, as well as data linked to political views, grocery purchases, banking activity, and health-related buying behavior.

The records involved totaled in the hundreds of millions and included names, email addresses, physical addresses, and phone numbers.

Regulators cited the company’s response to oversight as an aggravating factor. Datamasters initially asserted that it did not do business in California and did not handle data on Californians, then later acknowledged the opposite when presented with evidence. The firm also claimed it was manually screening data to exclude Californians.

The decision, signed Dec. 12, orders Datamasters to delete all previously purchased personal information belonging to Californians by the end of December. If the company receives Californians’ data in the future as part of larger datasets, it must delete that information within 24 hours. The firm is also required to maintain compliance measures for five years and submit a report detailing its privacy practices one year after the order.