Cybersecurity Policy Report, Data Broker Faces Fine in California Under CCPA, Delete Act, (Aug 11, 2026)

By Tony Foley

The California Privacy Protection Agency (CalPrivacy) announced today that it had issued a decision fining an Iowa-based data broker $116,490 and ordering it to change its practices after the company failed to register as a data broker in a timely fashion and unlawfully required Californians to provide a partial Social Security number (SSN) before exercising their opt-out rights.

The announcement highlights that, while CalPrivacy has brought more than a dozen enforcement actions against data brokers, this decision was the first against a broker under the California Consumer Privacy Act (CCPA) and the first to arise under both the CCPA and the DELETE Act.

The decision found that the broker, LocateSmarter LLC, collected personal information in part through licensing agreements, and made the information, including names, dates of birth, SSNs, and other information, available to its customers without timely registration as a data broker. In addition, the information sometimes included inferences about consumer characteristics, which are protected under the CCPA.

In addition, the decision found that LocateSmarter required California residents to provide unnecessary data, including the last four digits of their SSN, before they could opt out of the sale of their personal information. Requiring consumers to divulge part of their SSN could intimidate them and stop them from exercising their opt-out rights and also violates the CCPA’s data minimization requirements, CalPrivacy said.

“This case shows that we evaluate conduct through the lens of multiple laws to find the best fit to protect Californians,” said Michael Macko, CalPrivacy’s head of enforcement. “We did the same thing in the General Motors investigation [CPR, May 8] by partnering with the Attorney General and four District Attorneys, and we will continue taking a broad look as multi-state collaboration grows.”

In addition to the fine, the decision requires LocateSmarter to modify its methods for submitting and responding to opt-out requests by providing consumers with methods that are easy, require minimal steps, and do not require more information than necessary. The company also is prohibited from requiring verifiable consumer requests for consumers to exercise their opt-out rights and from requiring consumers to provide any portion of their SSN to do so. Finally, the decision mandates that LocateSmarter honor a consumer opt-our request to the extent that it is able to do so within the time period specified in the CCPA.

News: StateLegislation LitigationEnforcement DataPrivacy CCPA