California Brings First CCPA and Delete Act Enforcement Action Against Data Broker

1. California Expands Data Broker Enforcement Under the CCPA and Delete Act: California regulators brought their first enforcement action against a data broker under both the CCPA and the Delete Act, signaling increased scrutiny of businesses that collect and sell personal information without a direct consumer relationship.
   
   
2. Data Minimization Applies to Consumer Rights Requests: The decision makes clear that businesses cannot require consumers to provide more personal information than reasonably necessary to exercise their privacy rights. Regulators specifically challenged the collection of partial social security numbers in the opt-out process.
   
   
3. Companies Should Streamline Privacy Rights Requests: Consumers should be able to exercise their privacy rights through straightforward, low-burden processes.

California has brought its first enforcement action against a data broker under both the California Consumer Privacy Act (CCPA) and the Delete Act. In a decision issued on August 10, 2026, the California Privacy Protection Agency (CalPrivacy) approved a stipulated order requiring LocateSmarter LLC, an Iowa-based data broker, to pay $116,490 and modify certain business practices after regulators alleged that the company failed to register as a data broker and required consumers to provide excessive personal information, including partial Social Security numbers, to opt out of the sale or sharing of their data.

While modest in dollar value compared to some recent California privacy penalties, the matter is noteworthy because it is CalPrivacy’s first enforcement action against a data broker under the CCPA and the first case brought under both the CCPA and the Delete Act. The decision further signals that data minimization and consumer rights request procedures remain active enforcement priorities for California regulators.

Background

According to the CalPrivacy decision and stipulated final order, LocateSmarter is an Iowa company that provides data and analytics services focused on location services, fraud identification and detection, and compliance products. The company obtains personal information from third-party sources including data licensors, data brokers, analytics providers, and other suppliers, and then makes that information available to customers through various products and services.

LocateSmarter allegedly sold personal information that included names, dates of birth, Social Security numbers, physical addresses, telephone numbers, email addresses, employment information, driver’s license information, bankruptcy records, litigation history, military status, and deceased status information. The company also reportedly generated and disclosed certain inferences regarding consumers, including whether an individual had previously filed lawsuits and could be considered “litigious,” as part of its “WebRecon Litigious Scrub” service.

Data brokers are businesses that collect and sell consumers’ personal information to third parties with whom consumers do not have a direct relationship. CalPrivacy alleged, and LocateSmarter admitted in the stipulated order, that the company operated as a data broker during the 2025 calendar year. As a result, LocateSmarter was required to comply with California’s data broker registration requirements.

The Alleged Violations

The decision addresses alleged violations under both the Delete Act and the CCPA:

Failure to Register as a Data Broker

Under the Delete Act, businesses that qualify as data brokers must register with CalPrivacy by January 31 following any year in which they operate as a data broker. The agency alleged, and LocateSmarter stipulated, that LocateSmarter conducted business as a data broker during the 2025 calendar year but failed to register by the January 31, 2026, deadline.

The registration requirement plays a central role in California’s data broker regulatory framework because registration fees support both the Data Broker Registry and the state’s Delete Request and Opt-Out Platform (DROP), a centralized mechanism allowing consumers to direct registered data brokers to delete their personal information through a single request.

Opt-Out Process and Data Minimization Violations

The more notable aspect of the decision concerns LocateSmarter’s handling of consumer opt-out requests.

According to CalPrivacy’s findings, consumers seeking to opt out of the sale or sharing of their personal information were required to submit their full name, mailing address, and the last four digits of their Social Security number through the company’s online opt-out form. CalPrivacy concluded that this practice violated the CCPA, which prohibits businesses from requiring consumers to submit verifiable consumer requests to opt out of the sale or sharing of personal information.

The agency emphasized that opt-out rights differ from rights such as access, deletion, or correction because the potential harm associated with an impostor submitting an opt-out request is minimal. As a result, businesses may only request information reasonably necessary to process the opt-out request and must avoid collecting additional information where possible.

CalPrivacy further concluded that requiring consumers to disclose part of their Social Security number violated the CCPA’s data minimization requirements. CalPrivacy emphasized that Social Security numbers are among the most sensitive categories of personal information and noted that LocateSmarter possessed other less sensitive data points that could have been used if additional information was necessary. The agency also noted that requiring Social Security information could “intimidate” or discourage consumers from exercising their privacy rights altogether, in conflict with the CCPA’s mandate.

CalPrivacy also noted that only a “mere handful” of California consumers submitted opt-out requests to LocateSmarter despite California’s nearly 40 million residents, a fact the agency cited when discussing the potentially deterrent effect of the company’s process.

More broadly, the decision reinforces CalPrivacy’s view that the CCPA’s data minimization requirements apply not only to a business’s collection and use of personal information for commercial purposes, but also to information collected when consumers exercise their privacy rights.

The Order Requirements

The total monetary penalty amounts to $116,490 and consists of multiple components:

• $30,600 in administrative penalties under the Delete Act.
• $6,000 for the required annual data broker registration fee.
• $79,890 in administrative penalties under the CCPA.

In addition to the monetary penalties, LocateSmarter agreed to:

• Register as a data broker and comply with future registration obligations.
• Participate in and process requests received through DROP.
• Publish (in its privacy policy) required CCPA request metrics.
• Revise its opt-out request processes.
• Stop requiring consumers to provide any portion of a Social Security number when submitting an opt-out request.
• Ensure that opt-out mechanisms are easy to use and require only minimal information.
• Honor opt-out requests within the time period required by the CCPA.
• Train personnel responsible for handling CCPA consumer requests.

The company also admitted the factual findings contained in the stipulated order, waived its right to a hearing and appeal, and agreed to be bound by the order’s terms.

Regulatory Context

This decision arrives amid an increasingly active California privacy enforcement landscape. Only months earlier, California regulators secured a record $12.75 million settlement with General Motors over alleged sharing of connected vehicle data. The agency has also recently brought enforcement actions against Ford, Honda, PlayOn Sports, Tractor Supply Company, Todd Snyder, and multiple data brokers. The LocateSmarter matter continues a broader trend of applying privacy laws aggressively across a variety of industries.

The matter was handled by attorneys in CalPrivacy’s Data Broker Enforcement Strike Force, a specialized initiative that the agency launched on November 19, 2025, to pursue compliance issues within the data broker industry, underscoring CalPrivacy’s increasing focus on data broker activity.

The action also comes shortly after implementation of DROP, which allows California consumers to submit a single deletion request to participating data brokers rather than contacting each broker individually.

The decision is also significant because it demonstrates CalPrivacy’s willingness to apply multiple privacy statutes simultaneously. In the CalPrivacy press release, Michael Macko, the agency’s head of enforcement, noted that the CPPA evaluates conduct “through the lens of multiple laws” to identify the most effective enforcement strategy, signaling that businesses may increasingly face overlapping compliance obligations rather than isolated statutory reviews.

The decision also provides an early illustration of how CalPrivacy may use the Delete Act and the CCPA in tandem when evaluating data broker practices.

Key Takeaways

Data minimization extends to privacy request procedures. The decision makes clear that CalPrivacy views data minimization obligations as applying not only to ordinary business operations, but also to the collection of information used to process consumer rights requests. Businesses should evaluate whether every data element requested from consumers is truly necessary for the purpose at hand.

Opt-out rights should be frictionless. California regulators continue to focus on practices that make consumer rights more difficult to exercise. Any requirement that could discourage consumers from submitting requests may invite regulatory scrutiny.

Data brokers face heightened scrutiny. The combination of the Delete Act, the Data Broker Registry, the DROP system, and a dedicated Data Broker Enforcement Strike Force suggests that data brokers will remain a significant enforcement priority for California regulators.

Small consumer impact does not preclude enforcement. CalPrivacy highlighted that only a handful of opt-out requests had been submitted but still pursued the matter. The agency appears increasingly willing to enforce privacy rights violations, even where the quantifiable number of affected consumers is relatively small, if the actions taken by a business could potentially deter consumers from exercising their rights.

What This Means for Businesses Going Forward

The LocateSmarter decision provides an early roadmap for how California regulators may enforce the Delete Act and apply CCPA data minimization principles outside traditional data collection contexts.

Organizations should review all consumer rights request workflows, particularly opt-out mechanisms, to ensure they do not request more information than is reasonably necessary. Businesses should also carefully distinguish between requests that require identity verification and those, such as opt-out requests, that generally do not.

For data brokers, the message is even more direct. Registration requirements, participation in DROP, disclosure obligations, and consumer rights processes are now active enforcement priorities. As California continues to expand its privacy enforcement program, organizations that collect and sell personal information outside direct consumer relationships should expect increased scrutiny and should ensure that privacy compliance extends beyond written policies to the practical experience consumers encounter when exercising their rights.