California is raising the stakes through its continuing enforcement activities involving data brokers. On August 11, 2026, the California Privacy Protection Agency (“CPPA” or “Agency”) announced the Agency’s first ever enforcement action under the Delete Act, alleging LocateSmarter, LLC (“LocateSmarter”) failed to register as a data broker. Shortly thereafter, on August 13, the CPPA announced a subsequent enforcement action against Cybba, Inc.(“Cybba”), alleging similar violations of failing to register. These enforcement actions were announced just days after the CPPA voted to increase the data broker registration fee from $6,000 to $9,500.
For data brokers registered in California (and elsewhere), these developments point to a few trends. First, it does not seem like there will be any grace period for companies under the Delete Act. This is particularly important given that the registered data brokers in California are figuring out in real-time how to manage the hundreds of thousands of requests they have received through the state’s Delete Request and Opt-Out Platform (DROP).
Second, it is getting more expensive to be a data broker, and both regulators and legislators have no issue raising fees to regulate data broker activities. Lastly, if a company has not yet evaluated whether it falls within the scope of the data broker registration laws (or if its business practices have meaningfully changed such that it may now fall within the broad definition of this term), the risk of failing to register is greater than ever before, given that regulators are actively paying attention on this matter.
We have provided additional details on both enforcement actions below, as well as the new registration fee for data brokers in California. To stay up to date on the latest privacy law developments, please subscribe to the WilmerHale Privacy and Cybersecurity Law Blog.
LocateSmarter
The CPPA brought an enforcement action against LocateSmarter for failing to register as a data broker and requiring consumers to provide Social Security numbers and mailing addresses in order to exercise their opt-out rights. In addition to being the first action to arise under the Delete Act, it was also the Agency’s first action against a data broker under the California Consumer Privacy Act (CCPA).
According to the CPPA, LocateSmarter conducted business as a data broker by collecting and selling consumers’ personal information, including consumers’ Social Security numbers, phone numbers, email addresses, and physical addresses, to third parties who didn’t have a direct relationship with the consumers. However, LocateSmarter allegedly failed to register as a data broker with the CPPA by the Agency’s January 31, 2026 deadline for its 2025 data broker activities. Furthermore, LocateSmarter allegedly violated the CCPA by requiring consumers to provide more personal information than necessary to submit a request to opt-out of sale/sharing. According to the Agency, LocateSmarter violated the CCPA’s data minimization requirements by requiring consumers to provide their full name, the last four digits of their Social Security number, and their mailing address in order to submit an opt-out request. In the stipulated final order, the CPPA noted that requiring a Social Security number to submit an opt-out request was likely the reason that “only a tiny fraction of consumers submitted a request to opt-out of sale/sharing to LocateSmarter.” As part of the stipulated final order, LocateSmarter would be required to pay a $116,490 fine, modify its opt-out methods, and register as a data broker.
Cybba
The CPPA also brought an enforcement action against Cybba under the Delete Act for failing to register as a data broker by the Agency’s 2025 deadline for its 2024 data broker activities. According to the CPPA, Cybba conducted business as a data broker by collecting and selling consumers’ personal information, including geolocation data, internet activity data, inferences, identifiers, and commercial data, to clients for digital marketing and targeted advertising. Like LocateSmarter, Cybba sold the personal information to third parties who didn’t have a direct relationship with the consumers and allegedly failed to register as a data broker with the CPPA. Notably, this enforcement action was limited to Cybba’s alleged failure to register as data broker with the Agency by January 31, 2025 for its data broker activity during the 2024 calendar year, as Cybba timely registered with the CPPA for its 2025 data broker activities. As part of the stipulated final order, Cybba would be required to pay a $52,400 fine, disclose metrics regarding CCPA requests received, complied with, and denied during the previous calendar year in its privacy policy, and process deletion requests through the DROP.
Updated Registration Fee
As part of its board meetings on August 6 and 7, the CPPA voted to raise the annual registration fees for data brokers to $9,500, up from $6,000. The new fee goes into effect in January and will be relevant for companies as they look to renew their annual registration. According to the CPPA, the updated fee is intended to account for the increased costs associated with running and maintaining DROP, which went live in the beginning of August.
