ICYMI: California takes historic action against data brokers
California cracked down on data broker LocateSmarter with the first-ever enforcement action under Governor Newsom’s signature data broker privacy law.
What you need to know: Through the Delete Act, signed by Governor Newsom, and the California Consumer Privacy Act, California has taken its first action against an Iowa-based company that unlawfully required personal information before people could opt-out of the company’s sale of their data.
SACRAMENTO — Under Governor Newsom’s leadership, data brokers are starting to delete Californians’ personal information, and the state is taking action against companies not complying with two of the Golden State’s landmark consumer privacy laws. Over 475,000 Californians have already requested their data to be deleted through California’s one-stop-shop tool for deleting personal information from data brokers, and the California Privacy Protection Agency Board recently issued a decision taking action against Iowa-based data broker LocateSmarter LLC after the company failed to timely register as a data broker and unlawfully required Californians to provide sensitive personal information, including partial Social Security numbers, before they could opt out of the sale of their personal information. Recent action underscores California’s continued commitment to enforcing its nation-leading privacy laws and holding data brokers accountable.
Californians should have control over their personal data — not data brokers. Our nation-leading effort to give Californians the ability to control their personal information at the push of a button empowers people to take ownership of their data. Today marks a major milestone toward holding companies accountable when they make it harder for people to exercise that control.
Governor Gavin Newsom
Leading the nation in data privacy
In 2023, Governor Newsom, in partnership with the Legislature, enacted a first-in-the-nation privacy law — the Delete Act — that gives Californians more control over their data and the ability to tell data brokers to stop selling their personal information. As of January 1, 2026, Californians can submit a single deletion request to registered data brokers through the Delete Request and Opt-Out Platform (DROP). DROP quickly verifies the user’s California residency and then transmits the deletion request to the data brokers. The Delete Act requires data brokers to register with CalPrivacy, California’s Privacy Protection Agency, annually in January and pay a fee that funds the Data Broker Registry and DROP. As of August 1, 2026, data brokers are required under the Delete Act to begin processing deletion requests.
DROP helps give Californians better control over their data and simplifies the process of requesting that data brokers stop sharing and selling their data. Previously, consumers had to make requests to each data broker individually, making the process extremely difficult and time-consuming.
Taking action to keep Californians’ personal information protected
Earlier this week the California Privacy Protection Agency Board issued a decision requiring LocateSmarter LLC, an Iowa-based data broker, to pay a fine and change its practices. Although California has brought more than a dozen enforcement actions against data brokers, this is the first against a data broker under the California Consumer Privacy Act (CCPA), and the first to arise under both the CCPA and the Delete Act — signed into law by Governor Newsom in 2023.
The Iowa-based company also allegedly required Californians to provide the last four digits of their Social Security number before they could opt out of the company’s sale of their personal information. Requiring people to divulge part of their Social Security number could intimidate them and stop them from exercising their right to opt out.
Also this week, California issued a decision against an additional data broker, Cybba, Inc., after the company failed to register with CalPrivacy’s Data Broker Registry by the 2025 deadline.
For more information about the Delete Act and how Californians can submit a deletion request, visit https://privacy.ca.gov/drop/.
CalPrivacy oversees policy and enforcement of the Delete Act, and the California Department of Technology is responsible for delivering and maintaining the secure digital infrastructure that makes the DROP platform work statewide.
Strengthening consumer power
Under Governor Newsom’s leadership, California is leading the nation in strengthening consumer protections.
- Forcing social media platforms to make account cancellation straightforward, clear, and comprehensive.
- Empowering consumers with more information about the personal data brokers collect and who can access it.
- Requiring browsers to let Californians opt out of third-party data sales in one action, instead of website by website.
- Signed nation-leading executive orders in 2023 and 2026 to govern responsible AI adoption and procurement while protecting privacy and civil liberties.
- Strengthened the Department of Financial Protection and Innovation, giving it sharper tools to pursue bad actors.
- Pushed back against the federal government’s privacy violations and adopted best practices to minimize data collection and maximize protections for Californians.