Privacy & Cybersecurity Law Blog

On August 11, 2026, and August 13, 2026, the California Privacy Protection Agency (“CalPrivacy”) announced settlements with two data brokers, LocateSmarter LLC (“LocateSmarter”) and Cybba, Inc. (“Cybba”), respectively, resolving allegations that both companies failed to register as data brokers under California’s data broker law, the Delete Act. The LocateSmarter settlement also resolved claims for alleged violations of the California Consumer Privacy Act (“CCPA”), for requiring consumers to provide unnecessary sensitive personal information to exercise their opt-out rights. The LocateSmarter case marks CalPrivacy’s first enforcement action for alleged violations of both the CCPA and Delete Act.

LocateSmarter is an Iowa-based company that provides data solutions and analytics services, including location and contact services, fraud identification and detection and compliance products. The company collects personal information from third-party sources and sells it to clients through various means, including through an online search platform and data licensing products. The personal information sold includes consumers’ names, dates of birth, Social Security numbers, physical addresses, telephone numbers, email addresses, business and employment information, driver’s license information and bankruptcy and litigation data.

Cybba is a Boston-based company that sells personal information, including geolocation information, Internet activity data and identifiers, about consumers with whom it has no direct relationship to third-party businesses for marketing and advertising purposes.

Failure to Register as a Data Broker

Under California’s Delete Act, a “business” that knowingly collects and “sells” “personal information” (as such terms are defined in the CCPA) of consumers with whom it does not have a “direct relationship” (as defined in the Delete Act regulations) must register with CalPrivacy by January 31 following each year of such activity.

LocateSmarter allegedly operated as a data broker during the 2025 calendar year but failed to register by the January 31, 2026 deadline. Similarly, Cybba allegedly operated as a data broker in 2024 but did not register with CalPrivacy the following year. Cybba subsequently registered after CalPrivacy opened an investigation and contacted the company.

Unlawful Opt-Out Requirements  

CalPrivacy also found that LocateSmarter violated the CCPA’s data minimization requirements by making its opt-out process unnecessarily burdensome. In 2025, LocateSmarter’s online opt-out form required consumers to provide their full name, the last four digits of their Social Security number and their mailing address before they could submit an opt-out request for the sale or sharing of their personal information.

Under the CCPA and its implementing regulations, businesses may not require consumers to submit verifiable consumer requests to exercise their right to opt out of sale or sharing because the potential harm from an imposter submitting such a request is minimal or nonexistent. CalPrivacy found that LocateSmarter essentially required consumers to verify themselves with sensitive personal information despite this prohibition. The agency further noted that even if additional information were necessary to complete an opt-out request, LocateSmarter possessed other sensitive data points it could have used instead of a Social Security number.

CalPrivacy emphasized that requiring a Social Security number to submit an opt-out request could intimidate consumers from exercising their privacy rights, which conflicts with the CCPA’s mandate that consumers be able to easily exercise those rights. The agency noted that only a “tiny fraction” of consumers actually submitted opt-out requests to LocateSmarter out of California’s nearly 40 million residents.

Settlement Terms

LocateSmarter. Under the settlement with LocateSmarter, the company agreed to pay $30,600 in administrative fines for the alleged Delete Act registration violation and $79,890 for the alleged CCPA violations, for a combined total of $110,490. LocateSmarter must also pay a $6,000 data broker registration fee and submit its 2026 data broker registration within 14 days of the order.

In addition to the monetary penalties, the settlement requires LocateSmarter to modify its opt-out process to ensure it is easy, requires minimal steps and does not require more information than necessary. Specifically, LocateSmarter may no longer require consumers to provide any portion of their Social Security number to opt out. The company must also comply with CalPrivacy’s Delete Request and Opt-Out Platform (“DROP”), provide updated CCPA training to all personnel handling consumer requests and disclose required metrics in its privacy policy regarding the number of CCPA requests received, complied with and denied.

Cybba. Under CalPrivacy’s settlement order with Cybba, the company agreed to pay $52,400 in administrative fines for failing to register as a data broker. Cybba is also required to post metrics about the number of California consumers’ privacy rights requests received the previous calendar year, including requests to delete personal information, and the number of requests with which it has complied. Additionally, CalPrivacy ordered Cybba to access and process all  requests sent through DROP, which allows Californians to direct all registered brokers in the state to delete their data through a single request.

Key Takeaways

These settlements underscore CalPrivacy’s continued focus on data broker compliance and its willingness to take enforcement action against companies that fail to register or that create unnecessary barriers to the exercise of consumer privacy rights. Companies operating as data brokers in California should timely register in compliance with the Delete Act, comply with deletion requests submitted through DROP, and ensure that their consumer rights request processes do not impose unnecessary burdens on consumers.