California’s Data Broker Fine Marks A Privacy First

California just reached a new milestone in privacy enforcement.

The California Privacy Protection Agency (CalPrivacy) just imposed $110,490 in administrative fines against data broker LocateSmarter LLC for violations of the California Consumer Privacy Act (CCPA) and the Delete Act. The decision is the first against a data broker under the CCPA and the first to arise under both the CCPA and the Delete Act. In re LocateSmarter, LLC, No. ENF26-05-D-LO (Cal. Priv. Prot. Agency Aug. 10, 2026).

The violations also offer a practical warning for businesses: don't make consumers provide more personal information than necessary to exercise their privacy rights.

According to the order, LocateSmarter collected personal information from third-party sources and made it available to customers. That information included Social Security numbers, phone numbers, email addresses, driver’s license information, employment information, and bankruptcy and litigation information.

To opt out of the sale or sharing of their information, California consumers had to provide their full name, mailing address, and the last four digits of their Social Security number. CalPrivacy found that requiring the mailing address and partial Social Security number meant consumers had to provide more information than necessary to process the requests, violating the CCPA and its regulations.

The result was a $79,890 CCPA fine and an order requiring LocateSmarter to change its opt-out process, including eliminating any requirement that consumers provide a portion of their Social Security number.

LocateSmarter had another problem: it failed to timely register as a data broker. Although it operated as a data broker during 2025, it missed the January 31, 2026 registration deadline. That resulted in another $30,600 fine under the Delete Act, plus the $6,000 registration fee.

In short: if your CCPA opt-out process requires a mailing address, partial Social Security number, or other information that isn’t necessary to process the request, this decision is a good reason to revisit it.

See also: California’s New “One-Click Delete” Tool Could Reshape Privacy