California tightens data broker enforcement with $116,490 settlement over opt-out friction

California’s privacy regulator has issued a substantial settlement against Iowa-based LocateSmarter, linking compliance with the Consumer Privacy Act and the Delete Act. The case highlights the importance of straightforward opt-out processes amid growing enforcement on data broker transparency and consumer rights.

California’s privacy regulator has broadened its pressure on the data broker market with a $116,490 settlement that links two separate compliance regimes: the California Consumer Privacy Act and the state’s Delete Act. According to the California Privacy Protection Agency, LocateSmarter LLC, an Iowa-based company, was treated as a data broker but had allegedly failed to register properly. The agency also said the company made opt-out requests unnecessarily difficult by asking consumers for the last four digits of their Social Security numbers before they could submit a request to stop the sale of their personal information. The case matters because LocateSmarter’s business involved highly sensitive records, including names, driving licence details, dates of birth and information tied to employment, bankruptcy and litigation.

The agency’s message is practical as much as punitive. California’s data broker rules already require firms that buy, sell or trade personal information about people with whom they have no direct relationship to register and provide clear consumer-rights channels. The CPPA’s own guidance says data brokers operating in 2025, and newly operating in 2026, must create an account in the Delete Request and Opt-Out Platform, register and pay the annual fee between January 1 and January 31, 2026. The platform, known as DROP, is intended to let Californians request deletion of their data and opt out of future sales, and the state says the service is free to use.

For compliance teams, the main lesson is that friction can itself become a risk. California officials have indicated that privacy rights should be easy to exercise and limited to the information reasonably needed to process a request. LocateSmarter’s own privacy policy says California residents can opt out through a web form or by telephone, but the settlement suggests regulators will look closely at whether a process is genuinely usable rather than merely available on paper. The case also points to a broader enforcement trend: the CPPA is treating registration, data minimisation, deletion rights and opt-out design as connected obligations, not separate checkboxes.