Wrong on the Registry Is Still Wrong: CalPrivacy’s Accuracy Advisory for Privacy Disclosures

California’s privacy regulator just reminded data brokers that incorrect registration information costs money every day it stays wrong — and the accuracy lesson travels to every SMB privacy notice.

Foundations · Philosophy

James Venuto · Security Medic Consulting, LLC - AI Cyber Security and Privacy · September 24, 2026 · 8 min read

Last month’s LocateSmarter story was about friction in the opt-out. This month’s quieter — and equally important — story is about accuracy: whether the privacy story you file with a regulator (or publish to customers) matches what you actually do.

On September 3, 2026, CalPrivacy issued Enforcement Advisory No. 2026-01, Accuracy of Data Broker Registration Information. The advisory highlights data brokers who provide incorrect information in their annual registration with California’s data broker registry. The Enforcement Division has brought multiple actions over reporting errors. The Delete Act’s fine structure includes $200 for each day a data broker fails to register “as required” — and the advisory stresses that incorrect information in the registry is not a free pass just because the mistake was unintentional.

In CalPrivacy’s words (paraphrased from the advisory): the law does not distinguish unintentional mistakes from intentional misrepresentation when the result is incorrect information. Consumers and DROP (the Delete Request and Opt-out Platform) depend on truthful metrics, data categories, and sharing disclosures.

What the Advisory Is Really Saying

• Registration is not a formality. Annual Delete Act registration (by January 31), fees, DROP accounts (as of January 2026), and required metrics/disclosures are how Californians see who collects and moves their data.
• Wrong details create ongoing exposure. Each day incorrect information remains is a day of potential liability under the “as required” registration duty.
• “We didn’t mean to” is not the defense you want. Build a review step before you click submit — and a correction workflow when something changes mid-year.
• Enforcement is watching the registry. The advisory exists because the Enforcement Division keeps seeing bad data in the wild.

Why Ordinary SMBs Should Still Read This

Most firms are not data brokers. Many still publish privacy notices, CCPA “Do Not Sell/Share” pages, cookie banners, vendor lists, and marketing claims about how data is used. The same accuracy ethic applies:

• If your notice says you do not sell personal information, but an ad-tech partner’s contract says otherwise, you have an accuracy problem.
• If your public metrics or “last updated” dates are theater, regulators and plaintiffs notice when practice diverges.
• If you buy lists or “intent data,” you may be one hop from broker obligations — know whether Delete Act registration applies before CalPrivacy educates you the expensive way.

A Practical Accuracy Checklist This Month

1. Inventory every public privacy statement. Website notice, app notice, CCPA page, HR candidate notice — list URLs and last-reviewed dates.
2. Match statements to systems. For each “we collect / we share / we sell” claim, name the product or vendor that makes it true.
3. If you might be a broker, treat registration like financial reporting. Dual-person review of metrics and categories before filing; calendar a mid-year accuracy check after DROP volume changes.
4. Fix forward fast. When practice changes (new CDP, new ad pixel, new list partner), update the notice and any registry entry on a defined SLA — days, not quarters.
5. Train the humans who answer privacy email. They should know what the company already disclosed publicly so replies do not invent a second story.

This week’s action: Print or PDF your public privacy notice. Highlight every sentence about selling, sharing, or categories of recipients. For each highlight, write the vendor or system that proves it. Anything you cannot prove gets escalated to counsel or your privacy lead within five business days.

Soft Next Step

If you want a calm accuracy review of notices, sale/share inventory, and — where relevant — Delete Act registration hygiene — Privacy Medic / Security Medic can help Hudson Valley and regional SMBs close the gap before the next advisory becomes your case study.

References

1. CalPrivacy, “Enforcement Advisory Targets Incorrect Information in Data Broker Registration” (Sep 3, 2026): privacy.ca.gov/…
2. CalPrivacy, Enforcement Advisory No. 2026-01 (PDF): Advisory PDF
3. Related context — CalPrivacy SalesIntel Research late-registration decision (Sep 1, 2026): privacy.ca.gov/…