CalPrivacy Brings First Action Against a Data Broker Under Both the CCPA and Delete Act

August 11, 2026

SACRAMENTO, CA — The California Privacy Protection Agency Board has issued a decision requiring LocateSmarter LLC, an Iowa data broker, to pay $116,490 and change its practices after the company failed to register timely as a data broker and unlawfully required Californians to provide partial Social Security numbers before they could exercise their opt-out rights. Although the Agency has brought more than a dozen enforcement actions against data brokers, this decision is the first against a data broker under the California Consumer Privacy Act (CCPA), and the first to arise under both the CCPA and the Delete Act.

According to the decision, LocateSmarter collected personal information in part through licensing agreements, and then made this information available to its customers without timely registration as a data broker. The information included names, dates of birth, Social Security numbers, telephone numbers, email addresses, employment information, driver’s license information, bankruptcy and litigation information, and more. The information sometimes included inferences about consumer characteristics, such as whether they are “litigious.” Inferences are a protected form of personal information under California law.

LocateSmarter also allegedly required Californians to provide unnecessary data, including the last four digits of their Social Security number, before they could opt out of the company’s sales of their personal information. Requiring consumers to divulge part of their Social Security number could intimidate them and stop them from exercising their right to opt-out. Doing so also violates the CCPA’s data minimization requirements, as discussed in an earlier Enforcement Advisory on the application of data minimization to consumer requests.

“This case shows that we evaluate conduct through the lens of multiple laws to find the best fit to protect Californians,” said Michael Macko, the agency’s head of enforcement. “We did the same thing in the General Motors investigation by partnering with the Attorney General and four District Attorneys, and we will continue taking a broad look as multi-state collaboration grows.”

“The Board’s decision imposes a substantial fine even though a mere handful of consumers submitted requests to opt out, underscoring the need for businesses to take privacy rights seriously for each and every Californian,” said Tom Kemp, the agency’s executive director. “With the launch of the Delete Request and Opt-out Platform (DROP) earlier this year, Californians no longer need to hunt for data brokers on the registry and exercise their rights with each one, making it easier than ever to protect themselves.”

The Delete Act requires data brokers to register with CalPrivacy annually in January and pay a fee that funds the Data Broker Registry and DROP. DROP is a first-of-its-kind deletion mechanism that allows consumers to direct all data brokers to delete their personal information in a single request.

For the Enforcement Division, the case was handled by Attorneys Neelofer Shaikh and Gary Lee as part of the Data Broker Enforcement Strike Force. 

CalPrivacy’s Recent Enforcement Actions to Protect Californians

CalPrivacy is actively enforcing California’s cutting-edge privacy laws. Recent actions include:

• Partnering with California Attorney General Rob Bonta and state District Attorneys to hold General Motors accountable for data sharing practices from connected vehicles, resulting in a $12.75 million civil penalty and injunctive terms. 
• Issuing a decision requiring PlayOn Sports, the provider of digital ticketing platforms for high school sporting events, to pay a $1.10 million fine and change its practices to remedy privacy violations.
• Requiring Ford Motor Company to pay a $375,703 fine and change its practices to remove unnecessary friction in the opt-out process for Californians.
• Securing a settlement requiring Datamasters, a data broker, to pay a fine and stop selling lists of Californians who have Alzheimer’s disease and other health conditions.
• Issuing a decision requiring Tractor Supply Company, the nation’s largest rural lifestyle retailer, to pay a $1.35 million fine and change its business practices for California Consumer Privacy Act (CCPA) violations.
• Issuing a decision requiring a nationwide clothing retailer, Todd Snyder, Inc., to change its business practices and pay a $345,178 fine for CCPA violations.
• Issuing a decision requiring American Honda Motor Co. to change its business practices and pay a $632,500 fine for CCPA violations.
• Securing a settlement agreement requiring data broker Background Alert — which promoted its ability to dig up “scary” amounts of information about people — to shut down or pay a steep fine.
• Bringing more than a dozen enforcement actions against additional unregistered data brokers.
• Launching the bipartisan Consortium of Privacy Regulators to collaborate with states across the country to implement and enforce privacy laws nationwide.
• Partnering with the data protection authorities in Korea, France, and the United Kingdom to share information and advance privacy protections for Californians.

About Us

The California Privacy Protection Agency (CalPrivacy) is committed to promoting the education and awareness of consumers’ privacy rights and businesses’ responsibilities under the California Consumer Privacy Act, Delete Act, and Opt Me Out Act.

Consumers can visit Privacy.ca.gov to access helpful and up-to-date information and tips on how to exercise their rights, protect their personal information, and learn about the Delete Request and Opt-out Platform (DROP). In addition, CalPrivacy’s website provides important information about Board Meetings, announcements, and the rulemaking process.