CalPrivacy Fines Firms for Selling Health Data

California Regulator Fines Data Brokers Over Sensitive Health Data

CalPrivacy has hit two marketing firms with fines for illegally selling sensitive health information, including details on Alzheimer’s patients and individuals with drug addictions. Californians are increasingly asking, “Who can access my health data?” and “How is my private information protected?” These recent penalties highlight growing regulatory enforcement against data brokers exploiting vulnerable populations.

Datamasters Violates California’s Delete Act

The first firm, Datamasters, a Texas-based data broker, faces a $45,000 fine for failing to register with California’s Data Broker Registry. By not complying with the state’s Delete Act, the company broke legal requirements meant to protect Californians’ privacy. Datamasters had been selling personal information for targeted advertising without oversight, drawing sharp criticism from regulators and privacy advocates.

Sensitive Data Sold Without Consent

CalPrivacy revealed that Datamasters bought and resold private details of millions of Californians, including those with Alzheimer’s, drug addiction, and bladder incontinence. The company reportedly distributed highly sensitive data, such as names, addresses, phone numbers, and email addresses. This information was further categorized by age, race, political views, banking activity, grocery habits, and health-related purchases—raising serious ethical and legal concerns.

Activities Span Across Multiple Categories

The data broker’s operations, which began in 2024, targeted not just basic demographics but also behavioral and health-related data. By grouping consumers based on detailed personal information, the company enabled highly targeted marketing campaigns. Critics argue this exploitation of vulnerable groups exposes individuals to both privacy risks and potential manipulation.

Regulatory Action Puts Firms on Notice

Following the fines, Datamasters has been ordered to cease selling sensitive health information in California. This action signals a broader trend of stricter enforcement by CalPrivacy, which aims to ensure that companies respect privacy rights and comply with registration requirements. Regulators emphasize that violations of the Delete Act will face escalating penalties moving forward.

Privacy Advocates Urge Greater Awareness

Consumer privacy advocates stress the importance of public awareness about how data brokers operate. They recommend Californians check the Data Broker Registry and understand their rights under the state’s privacy laws. The case underscores that even everyday purchases and health details can be tracked and sold without consent unless strict oversight is enforced.

The Broader Implications for Data Protection

These fines illustrate California’s increasing commitment to protecting personal and health information from unauthorized sale. Companies nationwide are being reminded that privacy violations carry financial and reputational consequences. As data collection grows, transparency, registration compliance, and ethical handling of sensitive information will remain central to privacy enforcement.