California fines LocateSmarter for obstructing data opt-outs despite registration claims

California’s privacy regulator has imposed a $116,490 penalty on LocateSmarter LLC for making it harder for consumers to opt out of data sales, highlighting ongoing enforcement against data brokers undermining privacy laws.

California’s privacy regulator has imposed a $116,490 penalty on LocateSmarter LLC, saying the data broker made it harder than it should have been for people to stop the sale of their personal information. The action, announced on Tuesday, is the California Privacy Protection Agency’s first enforcement step tied to both the California Consumer Privacy Act and the state’s Delete Act, which was designed to make opting out of data sales simpler for residents.

The agency said the Iowa-based company failed to register as a data broker even though it was operating as one. It also said LocateSmarter required consumers to provide the last four digits of their Social Security numbers before they could exercise their opt-out rights, a verification step the regulator viewed as an unnecessary barrier. According to CalPrivacy, the firm collected names, driver’s licence details and dates of birth, along with information on employment, bankruptcy and litigation.

There is, however, a wrinkle in the public record. The California Department of Justice’s data broker registration page lists LocateSmarter as a registered broker and says consumers can use its filing to opt out of the sale of personal information under the CCPA. LocateSmarter’s own website also sets out privacy notices and request forms for Californians seeking to opt out, learn what data has been collected or request deletion, although those forms likewise ask for the last four digits of a Social Security number for verification.

The case fits a broader push by California to enforce its privacy rules more aggressively against data brokers. In January, CalPrivacy said it had opened a separate round of enforcement actions, including a $45,000 fine against Rickenbacher Data LLC for alleged failures to register and for selling Californians’ personal information. The agency’s latest move suggests that registration alone is not enough if a company’s opt-out process still places meaningful friction in front of consumers.