California Issues First Combined CCPA + Delete Act Enforcement Action, Fines Data Broker LocateSmarter $116,490

The California Privacy Protection Agency (CalPrivacy) approved a decision on August 10, 2026 imposing a $116,490 fine on LocateSmarter LLC, an Iowa-based data broker, in the agency’s first enforcement action brought under both the California Consumer Privacy Act and the state’s Delete Act simultaneously. CalPrivacy found LocateSmarter had operated as a data broker throughout 2025 without registering by the January 31, 2026 deadline, and had required consumers seeking to opt out of data sales to provide partial Social Security numbers — more sensitive data than the opt-out process is legally permitted to demand. CalPrivacy has separately settled with two other brokers, Cybba and SalesIntel Research, on related fact patterns.

The case lands as California’s Delete Request and Opt-out Platform (DROP) enters its enforcement phase: as of August 1, 2026, registered data brokers must check the DROP deletion registry every 45 days and process consumer deletion requests or face fines of $200 per request per day, and more than 475,000 deletion requests had already been filed by the time of this action. The LocateSmarter case establishes that CalPrivacy will pursue brokers who never registered at all, not only brokers who registered but processed deletions poorly — a meaningfully different and harder-to-detect violation.