Data broker fined after selling Alzheimer’s patient info and millions of sensitive profiles

California’s privacy regulator fined a Texas data broker, Datamasters (doing business as Datamasters), $45,000 and banned it from selling Californians’ personal information after it sold Alzheimer’s patient data, according to the California Privacy Protection Agency (CPPA).

The CPPA’s final order notes that Datamasters maintained a database with 435,245 postal addresses for Alzheimer’s patients and offered records for 2,317,141 blind or visually impaired people, 133,142 addiction sufferers and 857,449 people with bladder control issues.

It also sold information tied to ethnicity, including more than 20 million “Hispanic lists,” as well as age-based “senior lists” and indicators of financial vulnerability, and claimed to provide 3,370 Consumer Predictor Models covering automotive preferences, financial activity, media use, political affiliation and nonprofit activity.

Datamasters markets outright purchases and subscriptions, claiming coverage of 114 million households and 231 million individuals, but regulators found it had failed to register as a data broker in California under the Delete Act. The regulator noted that Datamasters “lacked sufficient written policies and procedures to ensure compliance with the Delete Act” and that registrants in California are liable for fines of $200 per day, with additional fines for failing to delete data. Starting 1 January 2028, California will require independent third-party audits for registered data brokers.