California’s Delete Act gets its first bite: two data-broker fines in eleven days
In this post
A new enforcement lever, not just a new law
Most cookie-consent coverage focuses on the front door: does the banner ask before tracking. California’s Delete Act targets the back door: data brokers who already hold your information and are supposed to erase it on request. The mechanism is DROP, the Delete Request and Opt-out Platform, which lets a Californian file one deletion request that every registered data broker is legally required to honor.
DROP has existed since 1 January 2026 for submitting requests. What changed on 1 August 2026 is that processing became mandatory: registered brokers now have to check the platform at least once every 45 days, act on pending deletion requests, and report status back through it. According to reporting on the statute, the penalty structure has no cure period: $200 per day, per unprocessed request, starting from day one of noncompliance, plus $200 per day for failing to register at all. That is a materially different posture from the notice-and-cure approach most people associate with CCPA enforcement.
Two fines, eleven days apart
The California Privacy Protection Agency (CPPA) Board did not wait long to use it:
- 11 August 2026: a Board decision against LocateSmarter LLC, an Iowa-based data broker, requiring a $116,490 payment. Coverage of the decision describes it as the agency’s first action against a data broker under the CCPA, and the first arising under both the CCPA and the Delete Act together. The violations cited: LocateSmarter registered late as a data broker, and required consumers to submit the last four digits of their Social Security number before it would process an opt-out.
- 13 August 2026: a second decision, against Cybba, Inc., a Boston-based data broker that sells geolocation, internet-activity data, and derived inferences for targeted advertising, requiring a $52,400 payment for missing the 2025 data-broker registration deadline.
Two enforcement decisions against data brokers, in the same week DROP’s processing mandate turned two weeks old, is a signal worth noting even before the dollar amounts: registration and opt-out friction are the first things the agency is checking, not an edge case.
Why the SSN detail is the part that travels
The fine amount is modest next to CNIL or ICO cookie penalties. What’s more instructive is the LocateSmarter theory: asking for a partial Social Security number as a precondition to opt out is treated as the kind of friction that undermines an opt-out right, similar in spirit to how EU regulators have gone after “reject” buttons that are technically present but functionally harder to use than “accept.” The lesson generalizes past data brokers, any opt-out or deletion flow that demands more identity verification than the request actually needs invites the same scrutiny.
Adoption is still catching up to the mandate
At its 7 August 2026 board meeting, the CPPA reportedly noted that only about 30 percent of registered data brokers had begun processing DROP requests in the first week after the 1 August deadline, against roughly 450,000 requests submitted to date. Separately, the Board approved a 2027 data-broker registration fee of $9,500, a $3,500 increase over 2026, attributed to added verification, infrastructure, and staffing costs. Read together, that’s an agency signaling it expects to be doing more of this kind of enforcement, not less, and is pricing its own capacity accordingly.
What this means if you’re in scope
If your business meets California’s data-broker definition, selling or sharing personal information you didn’t collect directly from the consumer, the practical checklist right now is short: confirm your registration is current, confirm someone is actually pulling from DROP on a schedule inside the 45-day window, and audit your opt-out flow for any verification step that isn’t strictly necessary to process the request. The per-day, no-cure penalty structure means a gap that would have been a warning letter under older CCPA enforcement is now a running meter.
Sources: CalPrivacy (privacy.ca.gov) press releases on the LocateSmarter and Cybba decisions (11 and 13 August 2026); CPPA 6-7 August 2026 board meeting materials; contemporaneous legal-industry reporting on DROP’s 1 August 2026 processing deadline and penalty structure (Crowell & Moring, MLex, IAPP, TechTimes).