What’s independently confirmed: Action News Now corroborates the core facts in CalPrivacy’s own release — a $52,400 fine against Cybba, a Boston-based broker that sells geolocation data, internet activity, and purchase-behavior inferences for targeted advertising, for missing the 2025 registration deadline. The order also requires Cybba to post privacy-rights metrics on its site and route future deletion requests through DROP, the state’s new Delete Request and Opt-out Platform. That much is documented case detail, not spin.
What’s still a claim, and whose: Agency enforcement chief Michael Macko frames this as part of a “steady drumbeat” that won’t slow down, and executive director Tom Kemp calls DROP a “game changer.” Those are agency talking points, not audited outcomes. The trend data that would validate them exists but predates this specific case — IAPP reported at a February 27, 2026 board meeting that registered brokers rose from 459 in June 2025 to more than 575 by February 2026, and that DROP logged roughly 242,000 consumer deletion requests, including 18,000 in its first 48 hours. That’s real growth, but it measures registry compliance and consumer uptake, not enforcement velocity — the two are related but not the same claim Macko is making.
Two enforcement actions in a week look less like momentum and more like a backlog finally clearing as CalPrivacy’s Data Broker Enforcement Strike Force works through its case list.
Independent reporting from Crowell & Moring and Hunton Andrews Kurth supplies the context CalPrivacy’s release omits: this strike force, formed in November 2025, already produced a $46,000 fine against Jerico Pictures (National Public Data) and a multi-year shutdown settlement with Background Alert in early 2025, plus the unrelated $12.75 million GM connected-car penalty cited by Action News Now. Against that backdrop, a $52,400 fine for late registration is modest in dollar terms but consistent in pattern — CalPrivacy is treating the $200-per-day registration penalty, as Crowell & Moring notes, as a floor rather than a ceiling, layering on DROP-integration mandates that carry ongoing compliance costs.
What would truly validate the “drumbeat” framing is a published tally of enforcement actions per quarter, something CalPrivacy hasn’t released alongside its press releases. Until then, brokers should watch whether the August 1 DROP integration deadline referenced by IAPP produces a third announcement soon — that would be the real test of whether this is a sustained cadence or a one-time sweep clearing a backlog.
CalPrivacy has been bringing a steady drumbeat of enforcement actions under both the Delete Act and the CCPA, and I don't see the enforcement activity slowing down anytime soon," said Michael Macko, the Agency's head of enforcement. "Especially with the launch of DROP, businesses should take a close look at their activities.
