California has taken its first action against an Iowa-based company that unlawfully required personal information before people could opt-out of the company’s sale of their data.
Data brokers are starting to delete Californians' personal information, and the state is taking action against companies not complying with two of the state's landmark consumer privacy laws.
Over 475,000 Californians have already requested their data to be deleted through California's one-stop-shop tool for deleting personal information from data brokers, according to the state.
The California Privacy Protection Agency Board recently issued a decision taking action against Iowa-based data broker LocateSmarter LLC after the company failed to timely register as a data broker and unlawfully required Californians to provide sensitive personal information, including partial Social Security numbers, before they could opt out of the sale of their personal information. Recent action underscores California's continued commitment to enforcing its nation-leading privacy laws and holding data brokers accountable.
“Californians should have control over their personal data — not data brokers,” Newsom said in a statement. “Our nation-leading effort to give Californians the ability to control their personal information at the push of a button empowers people to take ownership of their data. Today marks a major milestone toward holding companies accountable when they make it harder for people to exercise that control.”
In 2023, the state enacted a first-in-the-nation privacy law — the Delete Act — that gives Californians more control over their data and the ability to tell data brokers to stop selling their personal information.
As of Jan. 1, Californians can submit a single deletion request to registered data brokers through the Delete Request and Opt-Out Platform (DROP). DROP quickly verifies the user's California residency and then transmits the deletion request to the data brokers.
The Delete Act requires data brokers to register with CalPrivacy, California's Privacy Protection Agency, annually in January and pay a fee that funds the Data Broker Registry and DROP. As of Aug. 1, data brokers are required under the Delete Act to begin processing deletion requests.
State officials said that DROP helps give Californians better control over their data and simplifies the process of requesting that data brokers stop sharing and selling their data. Previously, consumers had to make requests to each data broker individually, making the process extremely difficult and time-consuming.
Earlier this week the California Privacy Protection Agency Board issued a decision requiring LocateSmarter LLC, an Iowa-based data broker, to pay a fine and change its practices. Although California has brought more than a dozen enforcement actions against data brokers, this is the first against a data broker under the California Consumer Privacy Act (CCPA), and the first to arise under both the CCPA and the Delete Act.
The Iowa-based company also allegedly required Californians to provide the last four digits of their Social Security number before they could opt out of the company's sale of their personal information. Requiring people to divulge part of their Social Security number could intimidate them and stop them from exercising their right to opt out.
Also this week, California issued a decision against an additional data broker, Cybba, Inc., after the company failed to register with CalPrivacy’s Data Broker Registry by the 2025 deadline.
