Recent Data Broker Enforcement Actions
California regulators are penalizing data brokers with significant fines following the launch of the new Delete Request and Opt-Out Platform (DROP). DROP is a tool that allows California consumers to submit a single request to delete their personal information and stop its sale across all registered data brokers. In August and September 2026, CalPrivacy (the California Privacy Protection Agency) penalized three companies, LocateSmarter, Cybba, and SalesIntel Research for failing to register or timely register as data brokers. On August 11, CalPrivacy announced its first action under the Delete Act, ordering LocateSmarter to pay a $116,490 penalty for failing to register as a data broker and for violations of the California Consumer Privacy Act’s (CCPA) consumer opt-out requirements. Shortly thereafter, CalPrivacy announced an enforcement action against Cybba, which agreed to pay a $52,400 fine for registering late and on September 1, 2026, the agency announced that SalesIntel Research must pay a $36,400 fine for failing to timely register with California’s data broker registry. These actions came right around the same time that the CalPrivacy board voted to increase California’s data broker registration fee from $6,000 to $9,500 signaling that the scrutiny and cost of operating as a data broker are both increasing.
Are You a Data Broker?
Businesses are considered data brokers if they collect and sell to third parties the personal information of consumers with whom the business does not have a direct relationship. Cybba met this definition by tracking and collecting behavioral data, internet activity, and geolocation information from consumers with whom it had no direct interaction, and selling this information to clients for targeted digital advertising. Similarly, LocateSmarter fell within the law’s scope by gathering personal information like names and phone numbers, as well as sensitive personal information like Social Security numbers, outside of any direct consumer relationship, and then selling this information to third-party clients for investigative and ID verification purposes. SalesIntel also falls within the law’s scope by gathering personal information like names, job titles, emails, and phone numbers outside of a direct consumer relationship, and selling this information to third-party clients as B2B lead data for targeted advertising purposes.
If your company sells or shares consumer data obtained outside of a direct customer relationship, it should evaluate whether data broker requirements apply. These requirements include registering annually with the privacy regulator, paying a registration fee, disclosing the types of data collected, and honoring global consumer deletion requests submitted through the state’s DROP platform. The analysis should not be treated as a one-time exercise. Changes to a company’s products, data flows, customers, or business practices can bring a company within the scope of the data broker law even if it previously concluded that registration was not required.
Why Data Brokers Must Take Notice
These recent actions show that a simple registration failure can trigger a broader review of a company’s privacy compliance program. Regulators are warning businesses that low opt-out volumes are not necessarily a sign of success if the underlying process is confusing, intimidating, or overly burdensome. Companies should audit their compliance programs for the following:
- Reassess registration triggers: Audit all data flows to verify whether personal information is obtained from consumers with whom the company does not have a direct relationship and whether that information is sold or shared with third parties.
- Keep workflows low-friction: Ensure deletion and opt-out methods are simple and do not require unnecessary or sensitive personal information.
- Prepare for DROP requests: Registered data brokers should ensure they have operational processes in place to receive and process deletion requests submitted through the DROP platform.
- Track annual registration deadlines: Registration obligations are recurring, and a company that registers one year may still face enforcement if it misses a later deadline.
Connected Compliance
The LocateSmarter case highlights how California regulators are increasingly looking at privacy through multiple lenses. Of LocateSmarter’s total $116,490 penalty, $79,890 was tied to CCPA violations LocateSmarter violated the CCPA by requiring consumers to provide their full names, addresses, and last four digits of their Social Security number in order to opt out of the sale or sharing of their personal information. This case provides warning that failure to register as a data broker could trigger a deeper regulatory review, exposing broader flaws in a company’s privacy practices. Similarly, the SalesIntel case highlights CalPrivacy’s stance on transparency. As part of its settlement for untimely registration, SalesIntel was required to publish in its privacy policy the exact number of CCPA requests it received, complied with, and denied during the previous calendar year. Companies should not treat CCPA compliance and data broker requirements as separate, isolated tasks. They are connected parts of a broader privacy compliance program, and a failure in one may expose vulnerabilities in the other.
