Millions of users' personal data was traded behind the scenes, and regulators just found out

Apparently, the Datamasters marketing firm has allegedly sold the health and personal information of millions of users... without being a registered data broker. And now, the California Privacy Protection Agency, or CalPrivacy, is reportedly taking action against it. 

CalPrivacy takes action against marketing firm that sold millions of users' data 

Rickenbacher Data LLC is the company in question here. It operates as Datamasters and has now been fined by CalPrivacy a notable $45,000 fine because it didn't register in time. The company has also been blocked from selling personal information that belongs to Californians, because it was found to seriously violate regulations. 

Reportedly, Datamasters bought and actually sold information of millions of people suffering from various medical conditions, including Alzheimer's disease, bladder problems, and drug addiction. As you would probably imagine, buying and reselling these people's information was done for targeted advertising.

CalPrivacy said that Datamasters also had lists of people based on age and "perceived race". Among the data bought and resold, there were 'Senior Lists' and 'Hispanic Lists'. There were also, reportedly, lists grouping people by their political views, purchases in grocery stores, banking activity, and purchases related to health. 

And if that's not shocking enough, the collected data also contained millions of records, including names, email addresses, real-world addresses, and even phone numbers. 

CalPrivacy tried multiple times to enforce compliance from Datamasters 

Reportedly, Datamasters resisted the regulatory actions and continued to operate as a data broker without being registered. 

The decision to fine the company was signed on December 12. The company was ordered to delete all previously purchased Californians' info by the end of December. 

Datamasters is also mandated to delete any data that it receives belonging to Californians within 24 hours of receiving it. 

But that's not all. The firm has also been ordered to maintain compliance for the next five years, as well as submit a report of its privacy practices one year later.

In the meantime, CalPrivacy has also fined S&P Global Inc. $62,600. The reason was that the company had failed to register for 2024 as a data broker (with the deadline being January 31, 2025). This violation, however, was due to an administrative error. The company has since registered as a data broker and taken corrective actions. Nevertheless, it was still punished. 

This data scandal shows how exposed your personal info really is

What bothers me here is how casually extremely sensitive data was treated. Health conditions, political views, even "perceived race" being packaged and sold like shopping habits is, in my opinion, incredibly unsettling. 

Most people have no idea this kind of profiling exists, let alone that it can happen without proper registration or oversight. If CalPrivacy hadn't stepped in, this could have easily continued under the radar.

It also shows why rules like the Delete Act matter. Companies often don't take privacy seriously until there are real consequences. A $45,000 fine isn't huge, but forcing Datamasters to delete the data and stay under watch for years is even a stronger message. 

Still, this makes me worry about how much control we really have over our personal information. And how many firms are quietly trading it behind the scenes.