[Enforcement library](/enforcement)

# LocateSmarter: never ask for Social Security digits before an opt-out

List the fields your opt-out form makes people fill in. If any of them proves identity, you have the problem CalPrivacy fined LocateSmarter for: its form asked for the last four digits of a Social Security number and a mailing address before it would accept an opt-out of sale.

California Privacy Protection Agency (CalPrivacy) · CCPA and Delete Act · Board decision 10 August 2026

## The problem

LocateSmarter, an Iowa data broker, sold Californians' names, dates of birth, Social Security numbers, addresses, phone numbers, employment, driver's licence, bankruptcy and litigation information to business clients ([Order, ¶¶ 7–9](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order_LocateSmarter-LLC-.pdf)). People who wanted it to stop selling their data had to use an online form that required their full name, the last four digits of their Social Security number and their mailing address (¶ 24). The order records that "a mere handful" of California consumers ever submitted an opt-out (¶ 30).

- The problem
- Case record
- What the regulator found
- What the order requires
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Regulator | California Privacy Protection Agency; decision by its Board, Chair Jennifer M. Urban (\[Order, p. 1\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| Case number | ENF26-05-D-LO |
| Parties | CPPA Enforcement Division v. LocateSmarter, LLC |
| Counsel | Enforcement Division attorneys Neelofer Shaikh and Gary Lee, Data Broker Enforcement Strike Force (\[Announcement\](https://privacy.ca.gov/2026/08/calprivacy-brings-first-action-against-a-data-broker-under-both-the-ccpa-and-delete-act/)); Much Shelist, P.C. for LocateSmarter (\[Order, p. 13\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| Laws | CCPA, Civ. Code § 1798.100(c); 11 CCR §§ 7002(d) and 7026(d); Delete Act, Civ. Code § 1798.99.82 |
| Stage | Stipulated final order adopted by the Board, 10 August 2026; review waived (\[¶ 51\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| Amount | USD 110,490 in administrative fines, plus a USD 6,000 registration fee: USD 116,490 in total (\[¶¶ 36, 37, 41\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| Source review | 17 October 2026 |

LocateSmarter "admits the truth of the factual findings" in the order ([¶ 50](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order_LocateSmarter-LLC-.pdf)). By contrast, [Ford](/enforcement/ford) neither admitted nor denied its order's findings, and [Honda](/enforcement/honda) admitted only background paragraphs.

## What the regulator found

| Practice | What the law requires | What the order describes | Source |
| --- | --- | --- | --- |
| Late data broker registration | A data broker must register by 31 January each year for the previous year's activity (Civ. Code § 1798.99.82(a)) | LocateSmarter acted as a data broker in 2025 and did not register by 31 January 2026 | \[¶¶ 10–12\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf) |
| Verification before opt-out | A business may not require a verifiable consumer request to opt out; "to the extent that the business can comply with a request to opt-out of sale/sharing without additional information, it shall do so" (11 CCR § 7026(d)) | The form required a partial Social Security number and mailing address. LocateSmarter "essentially required consumers to verify themselves with sensitive personal information" | \[¶¶ 16–19, 24–26\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf) |
| Data minimisation | Collection must be "reasonably necessary and proportionate" (Civ. Code § 1798.100(c); 11 CCR § 7002(d)), including collection to process requests | A Social Security number is "more than the minimum" needed, and LocateSmarter held other, non-sensitive data points it could have used | \[¶¶ 20–23, 27–28, 31\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf) |

The order also says that asking for a Social Security number "could intimidate consumers from exercising their privacy rights" (¶ 29). CalPrivacy's announcement ties the finding to its earlier [Enforcement Advisory No. 2024-01](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/01/enfadvisory202401-1.pdf), which says data minimisation "appl\[ies\] to the processing of consumers' CCPA requests".

## What the order requires

Paragraphs are from the [stipulated final order](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order_LocateSmarter-LLC-.pdf).

- Pay a USD 30,600 Delete Act fine (¶ 36) and a USD 79,890 CCPA fine (¶ 41), each within 30 days.
- Pay the USD 6,000 annual fee and register for 2025 activity within 14 days (¶ 37), and register on time in future years (¶ 38).
- Publish the required metrics on CCPA requests received, complied with and denied (¶ 39).
- Process deletion requests through the Delete Request and Opt-out Platform (DROP) in each year it is a data broker (¶ 40).
- Offer opt-out methods that "are easy, require minimal steps, and do not require more information than necessary" (¶ 43(a)).
- Require no verifiable consumer request (¶ 43(b)) and no "portion of their Social Security number" (¶ 43(c)) to opt out.
- Complete the opt-out changes and train staff who handle CCPA requests, confirming both in writing within 60 days (¶¶ 44–45).

## Technical issue

- **Tools or vendors:** LocateSmarter's own online opt-out form. No third-party tracker is involved.
- **Where:** the form linked from its notice of right to opt out (¶ 24). The sales themselves ran through batch data, API data, an online search platform and data licensing (¶ 7).
- **What data:** full name, last four digits of the Social Security number and mailing address, all required to submit (¶ 24).
- **When:** in 2025, before any opt-out could be submitted.
- **How it came to light:** the Enforcement Division's Data Broker Enforcement Strike Force ([Announcement](https://privacy.ca.gov/2026/08/calprivacy-brings-first-action-against-a-data-broker-under-both-the-ccpa-and-delete-act/)).

**Inth's technical interpretation:** a skip-tracing business matches people on Social Security digits and addresses every day, so reusing that matching key for privacy requests looks natural to its engineers. The rules separate the two cases. Access, deletion and correction requests can be verified, because a false request harms the real person. An opt-out cannot be, because a false opt-out harms nobody (¶ 18). An opt-out form should therefore collect only what is needed to find the records, and act on that.

Illustrative pattern, not the defendant's code.

```ts
// Bad: the opt-out schema demands identity proof before it accepts anything
const OptOutRequest = z.object({
  fullName: z.string().min(1),
  ssnLast4: z.string().regex(/^\d{4}$/), // sensitive, and not needed to opt out
  mailingAddress: z.string().min(1),
});
app.post("/privacy/opt-out", async (req, res) => {
  const body = OptOutRequest.parse(req.body);
  await identity.verify(body); // verification step the rules forbid for opt-outs
  await optOuts.apply(body);
});
```

Illustrative pattern, not the defendant's code.

```ts
// Fixed: ask only for what locates the record, never an SSN, and apply it at once
const OptOutRequest = z.object({
  fullName: z.string().min(1),
  email: z.string().email().optional(),
  phone: z.string().optional(),
});
app.post("/privacy/opt-out", async (req, res) => {
  const body = OptOutRequest.parse(req.body);
  await optOuts.apply(body); // no verification gate; suppress matching records from sale
  res.json({ status: "honoured" });
});
```

## Timeline

| Date | Event |
| --- | --- |
| 2025 | LocateSmarter acts as a data broker; its opt-out form requires partial SSN and address (\[¶¶ 10, 24\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| 31 January 2026 | Registration deadline for 2025 activity passes without registration (¶ 12) |
| 2 and 3 August 2026 | LocateSmarter and the Enforcement Division sign the stipulated order (\[pp. 14–15\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| 10 August 2026 | Board adopts the order, effective immediately (\[p. 1\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| 11 August 2026 | CalPrivacy announcement (\[Announcement\](https://privacy.ca.gov/2026/08/calprivacy-brings-first-action-against-a-data-broker-under-both-the-ccpa-and-delete-act/)) |

## Outcome

LocateSmarter pays two administrative fines, USD 30,600 under the Delete Act and USD 79,890 under the CCPA, plus the USD 6,000 registration fee it had not paid. CalPrivacy announced the combined USD 116,490 ([Announcement](https://privacy.ca.gov/2026/08/calprivacy-brings-first-action-against-a-data-broker-under-both-the-ccpa-and-delete-act/)). The order does not say how either fine was calculated. The opt-out changes and staff training were due within 60 days, and the registration, DROP and metrics duties continue for every year LocateSmarter operates as a data broker. Each side bears its own fees and costs ([¶ 46](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order_LocateSmarter-LLC-.pdf)). If the Agency has to enforce the order, it can recover its fees (¶ 53).

## What it cost

| Item | Amount or term |
| --- | --- |
| Delete Act administrative fine | USD 30,600 (\[¶ 36\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| CCPA administrative fine | USD 79,890 (\[¶ 41\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| Annual data broker registration fee | USD 6,000, a fee rather than a fine (\[¶ 37\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| Opt-out redesign and staff training | Within 60 days (\[¶¶ 44–45\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order\_LocateSmarter-LLC-.pdf)) |
| Ongoing duties | Annual registration, DROP processing and request metrics while a data broker (¶¶ 38–40) |
| Agency fees | Each side bears its own (¶ 46) |

## Why it matters

CalPrivacy called this its first action against a data broker under the CCPA, and the first under both the CCPA and the Delete Act ([Announcement](https://privacy.ca.gov/2026/08/calprivacy-brings-first-action-against-a-data-broker-under-both-the-ccpa-and-delete-act/)). Its executive director said the decision "imposes a substantial fine even though a mere handful of consumers submitted requests to opt out". The lesson for any business is that the size of the fine did not depend on how many people were turned away.

It sits in a line of CPPA orders against friction on opt-outs: an email confirmation click at [Ford](/enforcement/ford), excess verification at [Honda](/enforcement/honda), and a misconfigured cookie banner at [Todd Snyder](/enforcement/todd-snyder). LocateSmarter adds data minimisation as a second, independent ground: asking for more than an opt-out needs breaches §1798.100(c) even before the verification rule applies. See [unequal choices or identity checks](/enforcement/issues/unequal-choices-or-identity-checks) and [CCPA](/enforcement/laws/ccpa).

## How Inth catches this

- **Code audit:** reads changes that create new collection, so a pull request that adds a Social Security field to a privacy request form appears as new collection of sensitive data, with the file, the data flow and the owner's decision kept as evidence. It does not decide whether the field is lawful.
- **Website audit:** not relevant to this finding. It watches third-party scripts and destinations, not the fields your own form requires.
- **Consent banner:** not relevant here. In California it treats Global Privacy Control as an opt-out of sale and sharing for that visitor's browser, but LocateSmarter's sales ran through batch, API, search and licensing products that a browser signal does not reach.
- **Evidence:** Code audit finding history: commit, pull request, file and decision.

Inth has no capability for Delete Act registration, DROP deletion requests or offline data sales; those need your own processes.

## Checks for your own systems

### In the repository

- Search privacy request schemas and form components for `ssn`, `dob`, `driverLicense` and address fields, and list which are required for an opt-out.
- Check that the opt-out handler does not call the identity verification service used for access and deletion requests.
- Confirm that opt-out requests cannot sit in a "pending verification" state.

### In the browser and network

- Open your opt-out form as a new visitor and record every required field.
- Submit it with only a name and an email address, and check that the confirmation says the request was honoured.
- With Global Privacy Control on, confirm that the browser signal is applied without a form.

### With the people responsible

- Ask whether the business meets California's data broker definition, and who registers it by 31 January.
- Ask who processes DROP deletion requests, and how often.
- Count last year's opt-out requests and compare them with traffic to the form; a very low number may mean the form discourages people.

## Sources and limits

- [Order of decision and stipulated final order, 10 August 2026](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Order_LocateSmarter-LLC-.pdf)
- [CalPrivacy announcement, 11 August 2026](https://privacy.ca.gov/2026/08/calprivacy-brings-first-action-against-a-data-broker-under-both-the-ccpa-and-delete-act/)
- [CPPA Enforcement Advisory No. 2024-01](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/01/enfadvisory202401-1.pdf)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit LocateSmarter's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Ford](/enforcement/ford) · [Honda](/enforcement/honda) · [Unequal choices or identity checks](/enforcement/issues/unequal-choices-or-identity-checks) · [CCPA](/enforcement/laws/ccpa)