California Fined a Data Broker for Making Opt-Outs Hard
To stop a company called LocateSmarter from selling your personal information, you first had to give it the last four digits of your Social Security number. Read that again. A data broker that had collected your name, date of birth, driver's license details, and employment history without ever dealing with you directly required you to hand over more sensitive data before it would consider letting you out. On August 11, 2026, California's privacy regulator ruled that this is illegal and ordered the company to pay 116,490 dollars. If you have ever abandoned an opt-out form halfway through because it demanded too much, this ruling is about you.
What did California actually decide?
The California Privacy Protection Agency, which now operates publicly as CalPrivacy, issued a decision requiring LocateSmarter LLC, an Iowa-based data broker, to pay 116,490 dollars and change its practices. The agency found two violations. First, the company operated as a data broker without registering with the state by the January 31 deadline, which the Delete Act requires. Second, and more significantly, it required Californians to submit their full name, mailing address, and the last four digits of their Social Security number before it would process a request to stop selling their information.
Two days later, on August 13, the agency announced a second decision, ordering Cybba, Inc., a Boston-based company that sells geolocation data, internet activity, and inferences about people it has no direct relationship with, to pay a 52,400 dollar administrative fine for failing to register. Cybba was the fourteenth data broker penalized for that. The LocateSmarter case, though, was a first: the agency's first enforcement action against a data broker under the California Consumer Privacy Act, and the first brought under both that law and the Delete Act together.
Why does the Social Security detail matter so much?
Because it establishes something bigger than one fine. The principle at work is data minimization, the rule that a business should only collect what it actually needs for the task at hand. CalPrivacy applied that principle to the opt-out process itself, holding that a company cannot demand extra sensitive information as the price of exercising a privacy right. The mechanism that is supposed to protect you cannot itself become a collection point.
Think about what LocateSmarter's requirement really asked. To reduce your exposure, hand a company that traffics in personal data an additional piece of the most sensitive identifier you have. Plenty of people would reasonably refuse and simply give up, which conveniently leaves the listing in place. The regulator's view is that friction of this kind is not a neutral administrative choice.
Is this a one-off, or a pattern?
A pattern, and an accelerating one. The agency has now brought more than a dozen enforcement actions against data brokers, and its head of enforcement described a steady drumbeat that he does not expect to slow. The timing is pointed too: these decisions landed the same month that registered brokers became obliged to start processing deletion requests through the state's central platform, which we cover in what California's DROP actually deletes. Days earlier, the agency had voted to raise the annual data broker registration fee from 6,000 to 9,500 dollars.
The number that should concern you most
Not the fines. It is this: roughly 575 data brokers have registered in California for 2026, and the agency itself believes thousands more have not. Both companies penalized in August were caught for exactly that, operating as brokers while staying off the register.
This matters practically, because California's centralized deletion platform only reaches brokers that registered. A company that never signed up never downloads the deletion list, and your request never arrives. Enforcement is closing that gap case by case, at a pace of roughly a dozen or so companies at a time, against a population the regulator estimates in the thousands. The unregistered broker holding your address today is not going to be reached by a state platform this year.
What does this mean for getting your data removed?
Two honest conclusions, pulling in different directions.
The encouraging one is that your rights are becoming real. A regulator with the power to fine is now treating deliberately awkward opt-outs as violations rather than inconveniences, and that pressure should gradually make removal processes less painful across the industry.
The sobering one is that this case documents, in an official finding, exactly why doing removals yourself is so demoralizing. Opt-out flows are frequently built to be hard: extra fields, sensitive identifiers, confirmation emails, forms that fail silently. Multiply that across dozens of sites, then repeat it every few months as listings rebuild from fresh public records, and the attrition rate explains a lot. Consumer Reports measured the outcome, finding that opt-outs done by hand or by automation cleared only about 27 percent of exposed listings, while removals handled by real people who monitor and refile reached roughly 70 percent. California just fined a company for one instance of the friction behind that gap. The friction is still the norm.
Opt-outs are designed to be exhausting. That is the point.
A regulator just confirmed what anyone who has tried already knows. A free scan shows which people-search sites publish your name, address, and phone, and our team of real people handles the forms, the follow-ups, and the refiling when listings come back.
Run my free scan Start free trialFrequently asked questions
Should I ever give my Social Security number to opt out?
Be very cautious. California has now treated demanding partial Social Security numbers for an opt-out as unlawful, and most legitimate removal processes need far less, typically a name, an email, and the listing you want removed. If a site insists on sensitive identifiers, that is a reason to question it rather than comply automatically.
Does this ruling help me if I do not live in California?
Indirectly, yes. The order applies to California, but national brokers often standardize their processes rather than maintain separate flows per state, so pressure in California tends to improve opt-out design everywhere. Your enforceable rights still depend on your own state's law.
How do I know whether a broker is registered?
California publishes its data broker registry, and several other states now maintain their own. Searching those lists tells you which companies have declared themselves, though remember the agency believes many operating brokers never registered at all, so absence from a registry does not mean absence of your data.
Can I complain about a broker with a difficult opt-out?
Yes. California residents can file complaints with CalPrivacy, residents of other states with comprehensive privacy laws can complain to their attorney general, and anyone can report practices to the Federal Trade Commission. Enforcement priorities are shaped by patterns in complaints, so reporting genuinely contributes.