Overview
- In August 2026 the California Privacy Protection Agency Board issued a stipulated final order requiring LocateSmarter LLC to pay $116,490, to pay a $6,000 annual broker fee, and to waive further hearings or appeals.
- State regulators found LocateSmarter acted as a data broker in 2025 but failed to register by the Delete Act’s January 31, 2026 deadline, a lapse the order treats as a core violation.
- The final order says LocateSmarter collected and sold wide-ranging personal data—including names, dates of birth, Social Security numbers, contact and driver’s license details, bankruptcy and litigation records, and inferences—and unlawfully required requesters to provide partial Social Security numbers and mailing addresses to opt out.
- CalPrivacy pointed to DROP, its Delete Request and Opt-out Platform that has enrolled roughly 300,000 Californians, as a driver of enforcement because the tool centralizes device identifiers and triggers deletion and opt-out obligations for registered brokers.
- The decision is the agency’s first to combine authority under the CCPA and the Delete Act and signals that out-of-state brokers face stepped-up scrutiny, daily statutory penalties for nonregistration, and tighter limits on requiring excess personal information from consumers.