CalPrivacy’s Data Broker Enforcement Blitz Signals Increased Scrutiny

By Scott Hall and Phil Wiese

After a relatively quiet summer, the California Privacy Protection Agency (CalPrivacy) announced three enforcement decisions against data brokers over a three-week span. In each instance, the data broker allegedly collected and sold consumer personal information without timely registering with the CalPrivacy Data Broker Registry. Thousands of dollars in fines were levied against the three data brokers.

Each enforcement action was led by CalPrivacy’s Data Broker Enforcement Strike Force, a group constituted in November 2025 to specifically address compliance with the data broker registration requirement of the Delete Act. CalPrivacy has signaled that the Data Broker Enforcement Strike Force may bring additional actions in the coming months.

Below is a brief summary of the three enforcement actions as well as concrete steps for data brokers to take going forward.

LocateSmarter LLC

On August 11, 2026, CalPrivacy announced a $116,490 fine against Iowa-based data broker LocateSmarter LLC. The enforcement decision alleged that LocateSmarter failed to register timely as a data broker despite collecting and selling consumer personal information, including names, dates of birth, Social Security numbers, telephone numbers, email addresses, employment information, and driver’s license information. Locate Smarter allegedly used the personal information to make inferences with its collected personal information, including whether a consumer was “litigious.” However, despite allegedly selling consumer personal information, LocateSmarter did not register as a data broker by the January 31, 2026, deadline. CalPrivacy also faulted LocateSmarter for requiring unnecessary data to opt out of the company’s sale of personal information, including requiring consumers to provide the last four digits of their Social Security numbers. While the CCPA allows companies to verify a consumer’s rights to delete, know, or correct, the CCPA prohibits companies from requiring verification for the right to opt out of sale or sharing of data. This decision was CalPrivacy’s first arising under both the CCPA and the Delete Act.

Cybba, Inc.

Just two days later, on August 13, 2026, CalPrivacy announced an enforcement action and $52,400 fine against Boston-based Cybba, Inc. for failing register timely as a data broker. Cybba provides digital marketing and targeted advertising services on social media, and in doing so, allegedly collected and sold personal information including geolocation data, internet activity data, inferences, identifiers, and commercial data. However, Cybba did not register with CalPrivacy as a data broker by January 31, 2025.

SalesIntel Research, Inc.

In early September 2026, CalPrivacy announced a third enforcement action for failing to register with the agency’s Data Broker Registry. This action involved a $36,400 fine against Virgina-based SalesIntel Research, Inc., a company that, among other things, provides targeted advertising and data enrichment services to its customers. Sales Intel advertises that it has 200 million professional contacts and 54 million verified mobile phone numbers in its database. It uses that information for several of its services, including cleaning the data in its clients’ customer relationship management platforms and supplementing those platforms with additional data in the SalesIntel database.  SalesIntel also offers products based on its personal information database to “de-anonymize” website traffic and to derive inferences from a person’s online behavior and activities. Yet, like LocateSmarter and Cybba, SalesIntel failed to register as a data broker by the deadline to do so.

These enforcement actions coupled with the attention on the Delete Request and Opt-out Platform (DROP) signal CalPrivacy’s growing scrutiny over data broker registration and compliance.

Your Key Next Steps

Evaluate your data broker status. Under the California Delete Act, a data broker is any “business that knowingly collects and sells the personal information of a consumer with whom the business does not have a direct relationship.” If you meet this definition, absent one of the noted exceptions, you should register on the CalPrivacy Data Broker Registry.

Additionally, as noted in our article on the New Jersey Data Broker Law, businesses may have additional obligations in other states, even where they sell data from consumers with whom they have a direct obligation.

Confirm registration deadlines and maintain an annual compliance calendar. If your business qualifies as a data broker, determining that registration is required is only the first step. The recent enforcement actions demonstrate that CalPrivacy is willing to impose penalties for late registration even where a data broker ultimately registers. Businesses should identify applicable registration and renewal deadlines, assign responsibility for completing required filings, and establish controls to ensure filings are made on time.

Evaluate CCPA obligations as well as Delete Act obligations. Regulators are looking at all facets of a business.  CalPrivacy is not single-track focused on these issues. The LocateSmarter action demonstrates that CalPrivacy will combine infractions under the CCPA, Delete Act, and other privacy laws or regulations when bringing an action.

California Enforcement Actions

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com or Phillip Wiese at pwiese@coblentzlaw.com for further information or assistance.