SACRAMENTO — California has taken enforcement action against Iowa-based data broker LocateSmarter LLC, marking the state’s first data broker case under the California Consumer Privacy Act and the first involving both the CCPA and the Delete Act.

The California Privacy Protection Agency found that LocateSmarter failed to register as a data broker on time and unlawfully required consumers to provide sensitive information—including the last four digits of their Social Security numbers—before they could opt out of the sale of their personal data.

The company was ordered to pay a fine and change its practices.

“Californians should have control over their personal data—not data brokers,” Governor Gavin Newsom said. “We are making it easier for people to take ownership of their information and holding companies accountable when they interfere with those rights.”

One Request to Delete Personal Data

Governor Newsom signed the nation’s first-of-its-kind Delete Act in 2023, giving Californians greater control over personal information collected and sold by data brokers.

Since Jan. 1, 2026, Californians have been able to submit a single deletion request to registered data brokers through the Delete Request and Opt-Out Platform, known as DROP. After verifying that a user is a California resident, DROP sends the request to participating data brokers.

More than 475,000 Californians have already submitted deletion requests through the platform. Beginning Aug. 1, 2026, data brokers were required to start processing those requests.

Previously, consumers had to contact each data broker separately, making the process difficult and time-consuming. DROP provides a single platform for Californians to request that data brokers delete their information and stop selling or sharing it.

California Steps Up Data Broker Enforcement

The Delete Act requires data brokers to register with the California Privacy Protection Agency each January and pay an annual fee supporting the Data Broker Registry and DROP.

California has already brought more than a dozen enforcement actions against data brokers. In addition to the LocateSmarter case, the agency this week issued a decision against Cybba, Inc. for failing to register by the 2025 deadline.

State officials said requiring consumers to disclose part of their Social Security number could discourage them from exercising their privacy rights. The enforcement actions reflect California’s continued commitment to protecting personal information and holding data brokers accountable.