LocateSmarter ordered to simplify opt-outs and pay fines

On 11 August 2026, California's privacy regulator announced a decision against data broker LocateSmarter over late registration and excessive information demands in opt-out requests. It was the agency's first data-broker action combining the CCPA and Delete Act.

The order adopted on 10 August requires $110,490 in administrative fines plus a $6,000 registration fee. It found that demanding partial Social Security numbers and mailing addresses collected more information than necessary. The order requires simpler opt-outs and prohibits requesting any part of a Social Security number for that purpose.

Privacy teams should review each required field in rights-request forms and distinguish opt-outs from requests that permit identity verification. Data brokers should also check their registration process. The specific payment and remediation terms bind LocateSmarter; the underlying CCPA data-minimisation principles apply to covered businesses more broadly.