CalPrivacy fines LocateSmarter $110,000 over illegal SSN requests and CCPA breaches

What happened

• On Aug 10, 2026 CalPrivacy ordered Iowa‑based LocateSmarter, LLC to pay $30,000 for Delete Act violations and $80,000 for CCPA breaches after it demanded consumers' last four SSN digits to opt out.
• On Aug 13 and Sep 1, CalPrivacy fined Massachusetts‑based Cybba Inc. $52,400 and Virginia‑based SalesIntel Research $36,400 for failing to register as data brokers and required them to post privacy metrics and use the DROP platform.
• Colorado released a draft AI Act that will take effect on Jan 1, 2027, expanding consumer rights over automated decision‑making technologies.

Why it matters

Data brokers that collect or sell California residents' information must register, avoid requesting SSN fragments, and process deletion requests through the state‑run DROP platform; firms using AI decision tools in Colorado should prepare to disclose ADMT impacts and handle consumer response requests.

Business impact

Non‑compliant brokers face sizable fines and mandatory system changes, while Colorado AI deployers will need new compliance processes before the Jan 2027 effective date.

What to check

1. 1

   Register as a data brokerHigh priority

   File the required registration with CalPrivacy for the current year and pay the registration fee.

2. 2

   Remove SSN requirementsHigh priority

   Cease asking for any portion of Social Security numbers in opt‑out or deletion requests.

3. 3

   Post privacy‑rights metricsMedium priority

   Publish on your website the number of consumer deletion requests received and fulfilled each quarter.

4. 4

   Integrate with DROP platformHigh priority

   Connect your systems to CalPrivacy’s Delete Request and Opt‑Out Platform to process future deletion requests.