Why the CPPA Crackdown Matters

‍The California Privacy Protection Agency (CPPA) is actively targeting data brokers with enforcement actions under the CCPA and the Delete Act. These recent penalties signal a strict regulatory focus on annual registration compliance, unlawful friction in consumer opt-out processes, and rigorous data minimization requirements.

Overview pf the CPPA Crackdown on Data Brokers

‍ In August 2026, the CPPA announced back-to-back enforcement actions against two data brokers, demonstrating a continued aggressive approach to privacy compliance. In the first case, the agency fined LocateSmarter LLC, an Iowa-based data broker, $116,490 for failing to timely register and for unlawfully requiring California residents to provide the last four digits of their Social Security numbers to exercise opt-out rights. The agency noted that demanding sensitive information for opt-outs violates the CCPA's data minimization rules and acts as an intimidating hurdle for consumers.

Less than a week later, the CPPA announced a $52,400 fine against Cybba, Inc., a Boston-based data broker that sells geolocation and internet activity data for targeted advertising. Cybba failed to meet the Delete Act’s 2025 registration deadline. Alongside the financial penalties, both companies are mandated to implement practice changes, including utilizing the agency's newly launched Delete Request and Opt-out Platform (DROP). DROP is a centralized deletion mechanism allowing Californians to direct all data brokers to delete their personal information in a single request.

Key Implications or Developments of the CPPA Crackdown on Data Brokers

For enterprises and organizations operating within the data broker ecosystem, these actions underline the critical importance of adhering to the Delete Act's strict January registration deadlines. The CPPA's specialized "Data Broker Enforcement Strike Force" indicates that regulatory scrutiny in this sector will remain a high priority, with no leniency for missed timelines or administrative oversights.

Furthermore, the LocateSmarter decision serves as a broader warning to all organizations regarding consumer privacy rights and data minimization. Businesses cannot introduce unnecessary friction or demand excessive sensitive data when verifying or fulfilling data subject access requests (DSARs) or opt-out requests. Requiring information like partial Social Security numbers is now explicitly recognized as an intimidating practice that violates data minimization standards. Organizations must immediately evaluate their privacy portals and DSAR workflows to ensure they only request the minimum information necessary to authenticate consumer identities. As the CPPA continues its multi-state collaborative efforts, public sector and enterprise compliance teams should anticipate an increasingly coordinated and stringent regulatory environment across jurisdictions.

Expert Analysis by Fahad Diwan, JD, FIP, CIPP/M, CIPP/C, Director of Product Marketing, Privacy, Exterro

The CPPA’s back-to-back enforcement actions are a glaring wake-up call: regulators are no longer just looking at if you offer privacy rights, but how you offer them. The creation of a dedicated "Data Broker Enforcement Strike Force" proves that California is aggressively policing the data ecosystem.

But the biggest takeaway here extends far beyond data brokers. Fining a company for requiring a partial Social Security number to process an opt-out highlights a critical enforcement trend: weaponizing identity verification to create "friction" is a direct violation of data minimization principles. Asking consumers to surrender highly sensitive data just to exercise their privacy rights is a massive red flag for regulators.

Businesses should audit their data subject rights processes and opt-out workflows today. Businesses should ask themselves this one question: are you asking for more data than is necessary to verify an identity?

‍Data Privacy Tip‍

Eliminate unnecessary friction in your consumer request workflows to ensure CCPA compliance. Discover how Exterro's automated privacy solutions can help streamline data subject access requests while enforcing data minimization.

‍