Well the CPPA (state regulator) just hit General Motors with a $12.75M fine for selling data to two registered data brokers, and made the brokers who received the data delete it all: https://ccpa.world/enforcement/gm-onstar-smart-driver

Does it apply to Google? Well that's an interesting question. I think the answer is yes but the practical matter is that the CPPA is going to get some legal precedent and some more lawyers on staff before they take on Google. At the current number of requests in the DROP platform they could determine Google is an unregistered data broker and fine them $25B+, but I don't think they are going to do that this year.

I think within 36 months they will take the legal victories from prosecuting the first set of unregistered data brokers and apply it to the real players in the data ecosystem. At least, that's what I would do if I were Michael Macko.