Data Brokers Beware: California Settlement Highlights Risks in High-Friction Opt-Out Processes

Thursday, August 13, 2026

California’s privacy regulator just sent a clear message to the data broker ecosystem: compliance failures will be viewed across both the California Consumer Privacy Act (CCPA) and the Delete Act. The California Privacy Protection Agency (CPPA) announced a $116,490 settlement with LocateSmarter LLC, an Iowa-based company that allegedly operated as a data broker without registering as one. The CPPA also alleged that LocateSmarter made it too difficult for consumers to opt out of the sale of their personal information by requiring them to provide the last four digits of their Social Security numbers before submitting an opt-out request. According to the CPPA, LocateSmarter collected sensitive and high-risk data, including names, driver’s license information, dates of birth, and information about employment, bankruptcy, and litigation. The CPPA’s order emphasized that requiring consumers to provide more personal information than necessary, particularly sensitive information, can violate California’s data minimization requirements and discourage the exercise of privacy rights.

The takeaway for companies that are data brokers, or those that may fall within California’s broad data broker definition, is practical and immediate. First, companies should reassess whether they are required to register in California, especially if they buy, sell, license, trade, or otherwise share personal information about consumers with whom they do not have a direct relationship. Second, opt-out and deletion-rights workflows should be simple, low-friction, and limited to information reasonably necessary to process the request; asking for sensitive identifiers “just in case” may create enforcement risk. Third, low opt-out volumes should not be viewed as a compliance success story if the request process is confusing, intimidating, or overly burdensome. The CPPA’s comments also suggest that California regulators are increasingly looking at privacy practices through multiple legal lenses at once, meaning companies should treat CCPA compliance, data broker registration, data minimization, and consumer rights operations as connected parts of the same compliance program, not separate boxes to check.