California Fines Data Brokers to Enforce Stricter Consumer Opt-Outs
California fines data brokers for failing to comply with new consumer opt-out and registration laws.
Why it matters: These enforcement actions show California's commitment to stronger consumer data privacy, affecting how legal counsel advises clients on compliance with evolving privacy laws and data broker obligations.
- LocateSmarter LLC fined $116,490 for registration failure and demanding Social Security digits for opt-outs on August 11, 2026.
- Cybba, Inc. fined $52,400 for missing 2025 data broker registration deadline, announced August 13, 2026.
- Delete Act mandates annual data broker registration and processing deletion requests via the Delete Request and Opt-Out Platform (DROP).
- Since January 1, 2026, Californians can submit deletion requests through DROP, with data brokers required to act within 45 days starting August 1, 2026.
California continues to lead on consumer privacy enforcement, recently penalizing data brokers for failing to meet new regulatory requirements under the Delete Act and the updated California Consumer Privacy Act (CCPA). On August 11, 2026, LocateSmarter LLC was fined $116,490 for failing to register as a data broker and improperly requiring partial Social Security numbers to process opt-out requests.
Two days later, on August 13, the California Privacy Protection Agency (CalPrivacy) fined Cybba, Inc. $52,400 for missing the 2025 deadline to register with the Data Broker Registry. These actions underscore CalPrivacy's commitment to enforcement, with Michael Macko, Head of Enforcement, stating, "I don’t see the enforcement activity slowing down anytime soon."
The Delete Act, effective since 2023, requires data brokers to register annually and comply with consumer deletion requests through the state's Delete Request and Opt-Out Platform (DROP). Since January 1, 2026, over 475,000 Californians have utilized DROP to submit data deletion requests. Starting August 1, 2026, data brokers must process these deletion requests within 45 days, aligning with the updated operational standards.
CalPrivacy is also tightening scrutiny on how businesses honor consumer opt-out signals, such as Global Privacy Control (GPC). The agency has launched rulemaking on opt-out preference signals and is imposing new audit requirements on data brokers. These include increased registration fees starting in 2027 and mandatory independent third-party audits beginning January 1, 2028, as noted in a recent industry analysis.
Governor Gavin Newsom emphasized, "Californians should have control over their personal data — not data brokers." Legal professionals must now guide clients through these evolving mandates to avoid enforcement risks and ensure compliance with California's rigorous privacy landscape.
By the numbers:
- $116,490 — fine imposed on LocateSmarter LLC for registration and opt-out violations
- $52,400 — fine imposed on Cybba, Inc. for failing to register by 2025 deadline
- 475,000+ — Californians who have submitted data deletion requests through DROP as of August 13, 2026
- 45 days — maximum time data brokers have to process deletion requests starting August 1, 2026
What's next: Data brokers will face new registration fees starting in 2027 and mandatory independent third-party audits beginning January 1, 2028, increasing compliance demands.