CalPrivacy Fines Data Broker Cybba $52,400 for Failing to Register Under the Delete Act

The California Privacy Protection Agency (CalPrivacy) Board announced a decision on August 13, 2026 — two days after the LocateSmarter action — requiring Cybba, Inc., a Boston-based data broker, to pay a $52,400 fine after it failed to register with the state’s Data Broker Registry by the 2025 deadline. Cybba sells personal information, including geolocation data, internet-activity data, and behavioral inferences, to facilitate targeted advertising; one of its products uses signals from consumers’ purchasing behavior to identify likely repeat customers. Unlike the LocateSmarter decision issued days earlier, CalPrivacy’s own press release describes the Cybba violation as a registration-failure matter only — it does not allege the excessive-data-demand (partial Social Security number) conduct found in LocateSmarter. In addition to the fine, the decision requires Cybba to post privacy-rights metrics on its website, access CalPrivacy’s Delete Request and Opt-Out Platform (DROP), and process future deletion requests through it. The case was handled by CalPrivacy’s Data Broker Enforcement Strike Force (Attorneys Neelofer Shaikh and Gary Lee).

Why This Event Matters

Coming within a week of LocateSmarter, this action establishes that late/non-registration alone — independent of any data-minimization violation — is sufficient grounds for a CalPrivacy Delete Act enforcement decision, and signals a sustained enforcement cadence (“a steady drumbeat,” per CalPrivacy’s head of enforcement Michael Macko) rather than a one-off case.

Research Gaps

• Whether Cybba’s registration failure is now cured (current registry status not checked as of this entry).

Related Entries

• 2026-08-10–calprivacy-first-combined-ccpa-delete-act-enforcement-locatesmarter
• 2026-09-01–calprivacy-third-enforcement-action-salesintel-research-data-broker
• 2026-08-01–california-drop-platform-live-first-centralized-data-broker-deletion