California’s privacy regulator has brought its first enforcement action combining the state’s core privacy law with its newer data broker rules, and the target was a company most marketers have never heard of. The California Privacy Protection Agency announced on August 11, 2026 that it fined LocateSmarter LLC, an Iowa-based data broker, $116,490 for failing to register on time, unlawfully demanding partial Social Security numbers from consumers exercising opt-out rights, and violating data minimization requirements under the CCPA. “This case shows that we evaluate conduct through the lens of multiple laws to find the best fit to protect Californians,” said Michael Macko, the CPPA’s Head of Enforcement.
The action lands three months after California’s Delete Request and Opt-Out Platform, known as DROP, went fully live on August 1, 2026, requiring every registered broker to check the platform every 45 days and process deletion requests or face fines. What makes the case notable is not the dollar amount, small by privacy-enforcement standards, but the signal that the agency will combine CCPA and Delete Act violations in one action rather than treat broker registration as a separate, lower-stakes track. “The Board’s decision imposes a substantial fine even though a mere handful of consumers submitted requests to opt out,” said Tom Kemp, the CPPA’s Executive Director, underscoring that regulators will act on small violations to set the standard early.
For martech and CDP vendors, the insight is in the timing, not the target. Enforcement almost always arrives first against the smallest, least defended companies, because they make the cleanest test cases. Any vendor whose stack ingests, appends or resells third-party data now has a concrete signal for how aggressively California will police DROP, months before larger brokers face scrutiny, including platforms that meet the broad broker definition through identity-resolution features, the same infrastructure now moving into the browser as an identity layer and the practice the FTC has separately signaled it will police just as aggressively.
