3.7 Million Health Records, a $45,000 Fine

Introduction

California fined a Texas company $45,000 for building a business out of selling people by health category. According to the state's privacy regulator, the company's lists held 435,245 records tagged with Alzheimer's, 2,317,141 tagged as blind or visually impaired, 133,142 tagged with an addiction, and 857,449 tagged with bladder-control problems. In May 2025, that same regulator fined a different broker $46,000. The other company's claim to infamy was a data breach that, according to the CPPA, spilled 2.9 billion records, Social Security numbers included. Same statute, same arithmetic, and the gap between selling millions of health tags and leaking a billion identities came out to about $1,000.

What jumped out at me is that neither number has anything to do with what was in the data. California doesn't price these fines by how sensitive the information is, or by how many people it touches. It prices them by how many days late the company filed a form. Two hundred dollars a day, running like a parking meter. And you don't need a diagnosis to be in this story: the company, Datamasters, advertised a database of 231 million names and addresses, more than there are households in the entire country, sold at $40 per thousand with a 5,000-name minimum order. Your name is almost certainly one of them.

Sorted by Condition

On December 30, 2025, the board of the California Privacy Protection Agency signed a stipulated final order against Rickenbacher Data LLC, which does business as Datamasters, out of Flower Mound, Texas. The order, announced January 8, found the company had been buying and reselling the names, home addresses, phone numbers, and email addresses of millions of people, sorted not only by health condition but by age, "perceived race," political affiliation, and banking activity, all of it for targeted advertising, and it had never registered as a data broker the way California's Delete Act requires.

The catalog reads like a parody of itself. The order quotes Datamasters' own website advertising a "national consumer database" of 231 million individual names across 114 million households, a bulk file of 219 million records for a flat $9,500, a business file of 15 million companies, and a separate spreadsheet listing 204,218 California student records specifically. The health lists were priced like any other product on the shelf, $40 per thousand names with a minimum order of 5,000. For $200, then, a buyer could walk away with 5,000 names off the Alzheimer's list.

Datamasters' account of itself kept shifting as investigators pressed. First it told the agency it did "not do business in California" at all. Shown its own website, it admitted it had filled nationwide orders without screening Californians out. After hiring a lawyer, it changed course again and claimed it "screens all lists sold," a process the order flatly calls imperfect. One caveat: the company formally admitted some of the order's findings but neither admitted nor denied the specific record counts, so those four health numbers are the agency's finding, not a confession. Malwarebytes independently pulled the same four figures from the order, a useful check given the company never conceded them.

225 Days Times $200

Here's the number the coverage skipped. Paragraph 43 of the order fixes the violation window precisely: Datamasters ran as an unregistered broker from February 1 to September 13, 2025. Count those days inclusively and you get 225. The Delete Act's late-registration penalty runs $200 a day, under California Civil Code § 1798.99.82(c)(1). Multiply it out and 225 times $200 comes to $45,000, on the nose.

Once you see the formula, you see it everywhere. National Public Data, the broker behind that 2.9-billion-record breach, registered 230 days late and paid $46,000, a figure the agency itself called "the maximum penalty available under the law." Accurate Append paid $55,400 for 277 days. S&P Global, named the same day as Datamasters, paid $62,600 for 313. Every one lands on a clean $200-a-day multiple, moving with the calendar and nothing else.

Even the outlier fits. Background Alert, a "people search" site the agency pushed into a three-year shutdown instead of a straight fine, sat unregistered for 250 days, and its contingent $50,000 penalty lands on the same rate. Two smaller brokers, Growbots and UpLead, reportedly settled around $35,000 apiece, and none of it prices what was actually in the data. That drops you back at the comparison that should stop you cold: the company that leaked 2.9 billion Social Security numbers paid $1,000 more than the company that sold 3.7 million health-condition records. At $200 a day, that's a five-day gap on the calendar, the whole distance California's system could measure between those two.

Who Benefits

Datamasters and its owner, David Rickenbacher, got the obvious thing: years of business and a bill at the end that reads like a late fee. The order notes the company was active from 2020 through 2025, and it only drew scrutiny after skipping the 2024 registration. Registration isn't onerous, either. Brokers file once a year and pay a $6,000 fee, and the system is self-reported, so the agency mostly catches the ones who skip it through sweeps and outside tips. At $40 a thousand, a single mid-size order off one health list could cover a chunk of the fine, and the company ran many such orders across many years. Nobody disclosed Datamasters' revenue, so I won't pretend to know the exact ratio, but a business selling from a 231-million-name database does not get meaningfully deterred by $45,000.

The agency benefits too, in a quieter way. A "company filed its paperwork late" headline gets no clicks. "Broker sold lists of people with Alzheimer's" gets wall-to-wall coverage, which is exactly what happened. CPPA led its own press release with that angle and paired the sympathetic Datamasters case with the far drier S&P Global penalty in the same announcement, weeks before its new deletion platform went live. I don't read that as the agency doing anything improper. It pursued the case and won the largest penalty the statute allowed. But the framing does convenient work: it fixes your eye on the health data while the tool doing the actual pricing never looks at the data at all.

No Dial for the Data

None of this is a story about a lazy regulator. CPPA got the maximum the law allowed and stacked real remedies on top, ordering Datamasters to stop selling Californians' data, delete what it already held, adopt written compliance policies, and report back for five years. What's missing sits one level up, in the statute. California's Delete Act hands its enforcers a stopwatch for how late you filed and no scale at all for how much harm you did. Michael Macko, the agency's head of enforcement, said out loud that "reselling lists of people battling Alzheimer's disease is a recipe for trouble" and that "certain types of lists can be dangerous." He's right, and the penalty he was announcing couldn't see any of it.

The agency's next move proves it knows the difference. Starting August 1, 2026, every registered broker has to honor deletion requests through California's new platform, and the penalty for ignoring one is a different animal: $200 per consumer, per day. More than 322,000 Californians had already signed up as of July 1, according to the Mercury News, whose July 12 story is what put Datamasters back in the news. A CPPA lawyer has publicly floated that a single missed compliance cycle could theoretically reach $1.5 billion, the same $200 unit as the registration fine, aimed at volume instead of a date on a calendar. Priced that way, the penalty finally scales with how many people you touched, just not with the act of selling the lists in the first place.

That's the part that outlasts this one case. No buyer of a single Datamasters list is named anywhere in the record, and neither is the upstream supplier that licensed Datamasters the 231-million-name database to begin with. The order redacts the customers and never identifies the source. Accountability stops at whichever link in the chain forgets to file, and Datamasters is one broker out of a number nobody can put a figure to. The agency told the Mercury News it can't say how many unregistered brokers are still out there beyond the roughly 600 it already knows about. And everything Datamasters sold remains perfectly legal to sell, to buyers everywhere except California.

The Bottom Line

Strip off the Alzheimer's headline and the $45,000 was the cost of registering 225 days late, not a verdict on selling people by their health conditions, and it would have been the identical price if Datamasters had been trafficking in nothing more delicate than lawnmower warranties. You heard about this case because of the health data; what it actually cost Datamasters was the paperwork.

August 1 raises the price of one thing, ignoring a deletion request, and leaves the other thing, compiling and selling the lists in the first place, as cheap as it ever was. So the deadline puts a real question on the table. When a penalty finally scales with the number of people in the file, does it change the math for a company that advertised 231 million of them at $40 a thousand? Or does getting caught stay a rounding error, filed under the cost of doing business?