California Bans Data Broker Reselling Health Data Of Millions - Full Analysis

As per the California Delete Act, businesses buying and selling information about consumers are required to register their data brokerage activity by January 31st following each year.

Starting in 2026, this allows consumers to access an online platform called Delete Request and Opt-out Platform (DROP), where they can submit a request to all registered data brokers to remove their personal information.

Due to continued violations of significant severity, the Texas-based company has also been blocked from selling personal information belonging to Californians.

According to the agency's final order, Datamasters bought and resold user information of millions of people suffering from various medical conditions (e.g., Alzheimer’s disease, drug addiction, bladder incontinence) for targeted advertising.

The collected data consisted of hundreds of millions of records that included names, email addresses, physical addresses, and phone numbers.

An aggravating factor was the company’s stance on the state’s regulation efforts, claiming it did not do business in California or manage data of Californians, and later admitting the opposite when confronted with evidence and alleging that it was manually screening the data.

Despite multiple attempts to force the firm into compliance, Datamasters reportedly resisted, while continuing to operate as an unregistered data broker.

According to the decision, which was signed on December 12, the company was also ordered to delete by the end of December all previously purchased Californians' personal information.

If Datamasters receives in the future as part of larger data sets information belonging to Californians, the company has to delete it within 24 hours of receiving it.

"Although S&P Global acted quickly to register as a data broker and took corrective actions, the company was unregistered for 313 days," the agency notes in its decision to fine S&P Global.

Source: BleepingComputer