CalPrivacy Fines Two Data Brokers Under CCPA and Delete Act

CalPrivacy Fines Two Data Brokers Under CCPA and Delete Act

California's privacy agency entered stipulated enforcement orders against two data brokers in August 2026: a $116,490 penalty against Iowa-based LocateSmarter, LLC, the first case combining the CCPA and Delete Act, and a $52,400 penalty against Boston-based Cybba, Inc. for failing to register.

Information last verified on August 22, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This story covers two California Privacy Protection Agency enforcement orders under California's CCPA and Delete Act. It does not address data broker registration or enforcement in any other state.

What Happened

On August 10, 2026, the Board of the California Privacy Protection Agency, which now brands itself CalPrivacy, adopted stipulated final orders resolving two separate data broker investigations. The agency announced the LocateSmarter order on August 11, describing that decision as its first enforcement action against a data broker under the CCPA and the first to arise under both the CCPA and the Delete Act, and announced the Cybba order two days later, on August 13, as its second data broker enforcement action in less than a week.

In Case No. ENF26-05-D-LO, CalPrivacy found that LocateSmarter, an Iowa limited liability company based in Cedar Falls, sells consumers' names, dates of birth, Social Security numbers, addresses, phone numbers, employment information and driver's license data through batch data, API, online-search and licensing products. The agency found LocateSmarter met the Delete Act's definition of a data broker for its 2025 activity and missed the January 31, 2026 deadline to register under Civil Code section 1798.99.82(a).

The order also found a CCPA problem. LocateSmarter's online opt-out-of-sale form required consumers to submit their full name, mailing address and the last four digits of their Social Security number before the company would process the request. CalPrivacy's order states plainly what was wrong with that requirement:

"By requiring consumers to provide a partial Social Security number with their full name and mailing address to submit a request to opt-out of sale/sharing, LocateSmarter violated section 1798.100(c) of the CCPA and sections 7002(d) and 7026(d) of the regulations."

Stipulated Final Order, In the Matter of LocateSmarter, LLC, Case No. ENF26-05-D-LO (Aug. 10, 2026)

The order notes the practical effect: only a small number of Californians managed to submit an opt-out request to LocateSmarter, out of a state population of nearly 40 million. CalPrivacy Executive Director Tom Kemp said in the agency's announcement that the Board's decision "imposes a substantial fine even though a mere handful of consumers submitted requests to opt out."

LocateSmarter agreed to pay $30,600 for the Delete Act registration failure under Civil Code section 1798.99.82(c), a separate $79,890 administrative fine for the CCPA violations under Civil Code section 1798.199.55, and the $6,000 annual data broker registration fee under California Code of Regulations, title 11, section 7600(a). Those three figures total the $116,490 penalty the agency announced. The order gives LocateSmarter 30 days to pay the fines, 14 days to pay the registration fee and register, and 60 days to fix its opt-out form and confirm the fix in writing to the agency.

In Case No. ENF25-228-D-CY, CalPrivacy found that Cybba, a Delaware corporation based in Boston, sells geolocation, internet-activity and purchase-behavior data used to build advertising audiences for clients running campaigns on Facebook, Instagram, LinkedIn and YouTube. The agency found Cybba operated as a data broker in 2024 and missed the January 31, 2025 registration deadline. According to the order, Cybba registered only after the Enforcement Division opened an investigation and contacted the company, and it registered again on time in 2026 for its 2025 activity.

Unlike LocateSmarter's order, Cybba's stipulated order rests on the Delete Act's registration duty alone. The order specifically limits its own scope: it will not "constitute or be construed as a release from liability for any violation of law other than Cybba's violation of the Delete Act, Civil Code section 1798.99.82(c), arising from the company's failure to register as a data broker with the Agency between February 1, 2025 and October 20, 2025." Cybba agreed to pay $52,400 within 30 days, a figure consistent with the statute's $200-per-day formula applied across that 262-day unregistered period.

Both orders describe a negotiated resolution rather than a litigated verdict. LocateSmarter and Cybba each "admits the truth of the factual findings" in their respective orders and waived any right to a hearing, reconsideration or appeal, which let the Board adopt the stipulation without a contested proceeding.

"CalPrivacy has been bringing a steady drumbeat of enforcement actions under both the Delete Act and the CCPA, and I don't see the enforcement activity slowing down anytime soon."

Michael Macko, CalPrivacy head of enforcement, agency announcement, Aug. 13, 2026

What the Law Actually Says

The Delete Act's data broker provisions are codified at Civil Code sections 1798.99.80 through 1798.99.89. The underlying registration title dates to 2019, added by AB 1202. SB 362 substantially expanded it in 2023, adding the DROP deletion mechanism and the amendments now popularly called the Delete Act, and SB 361 amended it again in 2025. Section 1798.99.80(c) defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship. Section 1798.99.82(a) requires that business to register annually with CalPrivacy by January 31 of the year following the calendar year in which it met that definition. Section 1798.99.82(c) authorizes CalPrivacy to fine an unregistered broker $200 for each day it fails to register, plus the unpaid registration fee and the agency's investigation costs; that per-day formula lines up with the amount Cybba agreed to pay, as noted above. Our earlier coverage of the Delete Act's DROP deletion mandate explains how the registration duty connects to the deletion system both orders also address.

That deletion system is DROP, the Delete Request and Opt-Out Platform, established under section 1798.99.86. A California consumer can submit one verified deletion request through DROP rather than contacting every broker individually; consumers gained that ability on January 1, 2026, and the deletion mandate for registered brokers took effect August 1, 2026. Registered brokers must access DROP at least once every 45 days, match incoming requests against their own records, and delete the matched consumer's personal information, or process an unverifiable request as an opt-out, within that same window. Both orders require LocateSmarter and Cybba to access DROP and process deletion requests under section 1798.99.86 going forward. See our guide to how states require data brokers to register for how California's approach compares to other states.

The CCPA point in LocateSmarter's order is a separate legal theory from the Delete Act. Civil Code section 1798.100(c) requires a business's collection of personal information to be reasonably necessary and proportionate to the purpose of the collection, and CalPrivacy's regulations at California Code of Regulations, title 11, sections 7002(d) and 7026(d) apply that principle specifically to opt-out-of-sale requests. A business may ask for only the information needed to complete the request, and it may not demand a verifiable consumer request, the higher-friction identity check the CCPA allows for deletion, access or correction requests, before honoring an opt-out. Our page on California's opt-out rules for businesses covers what a business can and cannot ask a consumer to provide.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

These orders read less like a single dramatic finding and more like an agency closing a compliance gap it had already flagged. DROP's own deletion mandate for registered brokers took effect August 1, 2026, and CalPrivacy has been building out the Data Broker Registry the Delete Act depends on. An enforcement pair against companies that skipped that registry, arriving nine days into the deletion mandate, signals that registration is the gate CalPrivacy is willing to enforce first, ahead of the underlying data practices a broker engages in once it is registered.

The LocateSmarter order reaches further, into how a company handles the CCPA's own opt-out mechanics, and that pairing is the genuinely new element. Requiring a partial Social Security number before honoring an opt-out request is not a novel legal theory; the CCPA's data minimization rule has applied for years. Combining that finding with a Delete Act registration failure in a single order shows CalPrivacy is willing to evaluate one company's conduct under both statutes at once, rather than charging under whichever law fits most narrowly.

Cybba's order is narrower by design. The company registered late but registered, cooperated once the agency contacted it, and the order's own language carves out everything except the registration gap. That distinction is worth reading into the two penalty amounts: $116,490 against a company the agency also found had mishandled opt-out requests, and $52,400 against one that missed a registration deadline and then fixed it. The gap between the two figures tracks the gap in what each order actually found, not simply which company drew more scrutiny.

How This Affects You

If you believe a data broker sells or shares your information, the Delete Act now gives you one route to reach every registered broker at once, rather than contacting each company individually. Our guide to opting out of data brokers walks through how to use DROP and what to do about a broker that has not registered.

If a company asks for a Social Security number, a full mailing address, or another sensitive identifier before it will process a simple opt-out-of-sale request, these orders describe exactly the practice CalPrivacy found unlawful in LocateSmarter's case. A business may ask only for what it genuinely needs to complete that specific request. For more on what California's privacy law generally requires of businesses operating in the state, see our California data privacy law overview.

Nothing in either order applies outside California, and a stipulated order against these two named companies does not establish how CalPrivacy will treat any other business. It documents what CalPrivacy found in these two specific investigations and what LocateSmarter and Cybba agreed to do about it.

This is general legal information, not legal advice. It covers California's Delete Act and CCPA enforcement against LocateSmarter, LLC and Cybba, Inc. and reflects sources verified on August 22, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Our earlier coverage of California's DROP deletion mandate
• State data broker registration laws
• How to opt out of data brokers
• CCPA opt-out rights
• California data privacy law hub

---

Last updated: 2026-08-22. This is a developing story; details verified as of 2026-08-22.