Sign in Subscribe
CalPrivacy

In the Matter of ROR Partners, LLC

A practical analysis of CalPrivacy's ROR Partners decision, explaining why custom audiences, inferred profiles, and behavioral segments can constitute the sale of personal information and trigger California's data broker registration requirements.

Lydia

— 4 min read
Share
In the Matter of ROR Partners, LLC

Key points

  • This case marks one of the clearest statements to date that marketing and advertising firms can be data brokers under California law when they sell personal information — even when bundled into “value-added” services.
  • The CPPA reaffirmed that inferences, audience segments, and consumer profiles are protected personal information, and that “a sale is a sale,”regardless of product framing.
  • Failure to register as a data broker is itself an enforceable violation, independent of whether consumer harm or misuse of data is shown.
  • The decision reinforces the CPPA’s infrastructure-first enforcement strategy, tying registration, funding, and the upcoming Delete Request and Opt-Out Platform (DROP) into a single compliance ecosystem.

Background

ROR Partners, LLC is a marketing agency focused on the fitness and wellness sector. The company describes itself as the “#1 Fitness and Wellness Marketing Agency in North America,” advertising its ability to reach more than 100 million unique individuals monthly and deliver over one billion advertising impressions.

To do so, ROR Partners promotes a sophisticated data ecosystem built on first-party and third-party data, AI-driven audience modeling, and predictive analytics. ROR Partners collects personal information from a variety of sources, including its clients, third parties (e.g. health and fitness companies), and “Data Compilers” (i.e. data brokers.) Its services include the creation of custom audiences, behavioral segments, and consumer profiles designed to enable precise advertising and marketing campaigns for its clients.

In addition to enabling precise audience targeting for marketing campaigns, ROR Partners offers services to combine client’s information with ROR Partners’ own data for audience modeling. According to ROR Partners marketing, its data driven custom-audiences significantly out-perform look-alike and interest-based audiences created within advertising platforms.

During the 2024 calendar year, ROR Partners operated this data-driven marketing business while conducting business in California. Under the Delete Act, businesses that qualify as data brokers are required to register annually with the California Privacy Protection Agency by January 31 of the following year.

ROR Partners did not register by the January 31, 2025 deadline.

Findings of violation

On November 26, 2025, the California Privacy Protection Agency Board adopted a Stipulated Final Order finding that ROR Partners violated the Delete Act by operating as an unregistered data broker.

Collection and sale of personal information

The CPPA found that ROR Partners collected personal information from multiple sources, including clients, wellness companies, and data compilers, and used that information to create detailed consumer profiles and inferred attributes. These profiles were linked to internal identifiers (“ROR IDs”) and used to segment individuals into targeted audiences.

Crucially, the Agency found that ROR Partners made personal information and inferences available to its clients as part of its services, enabling those clients to target individuals based on predicted interests, behaviors, or characteristics — such as fitness engagement.

The CPPA concluded that these disclosures constituted sales of personal information under the CCPA, regardless of whether they were packaged within broader marketing or advertising services. The Order states plainly: “A sale is a sale.”

Data broker status

Based on these activities, the CPPA determined that ROR Partners:

  • Is a for-profit entity that determines the purposes and means of processing personal information;
  • Annually buys, sells, or shares the personal information of 100,000 or more consumers or households; and
  • Knowingly sells personal information of consumers with whom it does not have a direct relationship.

Accordingly, the Agency found that ROR Partners operated as a data broker during the 2024 calendar year and was therefore required to register under Civil Code § 1798.99.82.

ROR Partners’ failure to register by January 31, 2025 constituted a violation of the Delete Act.

Enforcement analysis

This case is less about novel legal theory than about regulatory clarity.

  • First, it squarely rejects a long-standing industry assumption: that marketing firms, adtech providers, or analytics companies are outside the data broker regime if they do not sell “raw data.” The CPPA made clear that selling inferred audiences, profiles, or segments is still selling personal information.
  • Second, the decision underscores that registration is not a technicality. The data broker registry is a core enforcement and accountability mechanism, designed to fund and operationalize California’s forthcoming Delete Request and Opt-Out Platform (DROP). Failure to register undermines that system — and will be penalized accordingly.
  • Third, the case illustrates the CPPA’s enforcement sequencing. Rather than beginning with DROP-related violations, the Agency is cleaning the registry first, identifying businesses that should be registered, bringing them into compliance, and signaling that enforcement will follow for those who remain outside the system.

The $50,000 administrative fine, combined with mandatory registration, fee payment, and ongoing compliance obligations, reflects a measured but firm approach: this is not a one-off warning shot, but part of a broader, scalable enforcement strategy.

Remedy and compliance obligations

Under the Stipulated Final Order, ROR Partners agreed to:

  • Pay a $50,000 administrative fine within 14 days of the Order;
  • Pay the required data broker registration fee and complete its 2025 registration for 2024 activity;
  • Timely register in any future year in which it operates as a data broker;
  • Update its privacy disclosures to include CCPA request metrics, as required by law; and
  • Waive rights to further administrative or judicial review.

ROR Partners admitted the factual findings and agreed that the settlement was fair, reasonable, and in the public interest.

Conclusion

In the Matter of ROR Partners, LLC reinforces a simple but consequential principle: if your business enables others to target or profile consumers using data those consumers did not give directly to you, California may consider you a data broker — regardless of what you call yourself.

As California prepares to launch DROP, the CPPA is making clear that the registry is the gateway to enforcement. Marketing, advertising, and analytics firms should take note: compliance starts not with clever product descriptions, but with an honest assessment of whether personal information is being sold — and whether registration is required.

Resources

Read more