On August 11, 2026, the California Privacy Protection Agency (“CalPrivacy”) announced its first enforcement action against a data broker under both the California Consumer Privacy Act (“CCPA”) and the Delete Act, signaling CalPrivacy’s willingness to evaluate business conduct through the lens of multiple privacy statutes.
The enforcement action involves LocateSmarter LLC, an Iowa-based data broker, that was ordered by the Agency’s Board to pay $116,490 in administrative fines and to overhaul its business practices. According to the Stipulated Final Order, which was formally adopted by the CalPrivacy Board on August 10, 2026, CalPrivacy found two principal violations:
(1) LocateSmarter collected and sold consumers’ personal information—including names, Social Security numbers, telephone numbers, email addresses, and inferences about whether consumers are “litigious”—through licensing agreements and various data products, all without timely registering as a data broker by the January 31, 2026 deadline; and
(2) that LocateSmarter’s opt-out request form required consumers to submit a partial Social Security number along with other identifying information—actions that violated the CCPA’s data minimization requirements by demanding more personal information than necessary to process an opt-out request. The Agency also found CalPrivacy also determined that the practice could potentially intimidate consumers from exercising their opt-out rights.
CalPrivacy officials emphasized that the substantial penalty—imposed despite only a handful of consumer opt-out requests having ben received—underscores its commitment to protecting the privacy rights of every Californian.
Under the terms of settlement, LocateSmarter admitted to the truth of these findings and agreed to bound by Order’s terms, which include the prompt payment of the fine and an agreement to modify its opt-out procedures to eliminate the Social Security number requirement. LocateSmarter also agreed to confirm completion of updated CCPA training for all personnel handling consumer requests.
CalPrivacy News Release | Order of Decision and Stipulated Final Order