A Handful Of Opt-Outs And A Six-Figure Fine: CalPrivacy’s Message To Data Brokers

On August 11, 2026, the California Privacy Protection Agency (CalPrivacy) announced a Final Stipulated Order between Iowa-based data broker LocateSmarter LLC and the agency, requiring LocateSmarter to pay $116,490 and change its privacy practices. This marks the agency’s first-ever CCPA decision against a data broker, and the first arising from both violations of the Delete Act and the CCPA. CalPrivacy alleged that the data broker failed to register under the state’s Delete Act and violated the CCPA by requiring consumers to provide unnecessary data to the data broker, including the last four digits of their Social Security numbers and mailing addresses before they could opt out of the sale of their personal data. 

The settlement arrives at a pivotal moment for data brokers. In January 2026, CalPrivacy launched its Delete Request and Opt-Out Platform (DROP), allowing consumers to submit a single deletion request covering its now 600-plus registered data brokers. Brokers were required to begin processing DROP requests by August 1. Further enforcement over deletion and disclosure obligations is expected.

The Stipulated Final Order noted that given LocateSmarter’s requirement to share part of the consumer’s social security number to submit an opt-out request, it was “no surprise that only a tiny fraction of consumers submitted a request to opt-out of sale/sharing….” In its press release, CalPrivacy’s executive director, Tom Kemp, stated that a substantial fine was imposed “even though a mere handful of consumers submitted requests to opt out, underscoring the need for businesses to take privacy rights seriously for each and every Californian.”

There are a few important takeaways for businesses that collect and sell consumer data. First, this action shows that CalPrivacy intends to enforce the Delete Act just as DROP is launching—a significant fact given some of the technical and operational challenges to using DROP. Further, CalPrivacy appears to be signaling that it will impose substantial penalties even when only a handful of consumers are directly affected. In other words, CalPrivacy is not focusing only on the biggest players with the largest amount of requests. Finally, even if not subject to the Delete Act, businesses should review their CCPA compliance more generally, as CalPrivacy may be signaling quick enforcement on upcoming issues like privacy risk assessments and cybersecurity audits.