The California Privacy Protection Agency (CalPrivacy) has taken action against the Datamasters marketing firm that sold the health and personal data of millions of users without being registered as a data broker.
As per the California Delete Act, businesses buying and selling information about consumers are required to register their data brokerage activity by January 31st following each year.
Starting in 2026, this allows consumers to access an online platform called Delete Request and Opt-out Platform (DROP), where they can submit a request to all registered data brokers to remove their personal information.
In the case of Rickenbacher Data LLC, operating as Datamasters, CalPrivacy imposed a $45,000 fine for failure to register in time.
Due to continued violations of significant severity, the Texas-based company has also been blocked from selling personal information belonging to Californians.
According to the agency's final order, Datamasters bought and resold user information of millions of people suffering from various medical conditions (e.g., Alzheimer’s disease, drug addiction, bladder incontinence) for targeted advertising.
"In addition, Datamasters bought and resold lists of people based on age and perceived race, offering 'Senior Lists' and 'Hispanic Lists,' as well as lists based on political views, grocery store purchases, banking activity, and health-related purchases," CalPrivacy says.
The collected data consisted of hundreds of millions of records that included names, email addresses, physical addresses, and phone numbers.
An aggravating factor was the company’s stance on the state’s regulation efforts, claiming it did not do business in California or manage data of Californians, and later admitting the opposite when confronted with evidence and alleging that it was manually screening the data.
Despite multiple attempts to force the firm into compliance, Datamasters reportedly resisted, while continuing to operate as an unregistered data broker.
... continue reading