Blogs

Who’s afraid of the CPPA?

9/21/26

By: Fredrick Hagen and Kayli Clifford

If Big Tech is not the CPPA’s immediate target for CCPA/Delete Act enforcement, who is?

A “Mere Handful” of opt-out requests sparked the CPPA’s first CCPA/Delete Act Enforcement Action

In the wake of the August 1, 2026 Delete Act compliance deadline, the California Privacy Protection Agency Board approved a stipulated order requiring LocateSmarter LLC, a small company based in Iowa, to pay $116,490 and change its practices after allegedly failing to register timely as a data broker and requiring Californians to provide excessive personal information, including partial Social Security numbers, before exercising opt-out rights. According to the order, LocateSmarter LLC provides data solutions and analytics for clients in industries involving location and contact services, fraud identification and detection, and compliance products.

The decision is significant not only because it is the Agency’s first data-broker enforcement action under the CCPA and the first to arise under both the CCPA and the Delete Act, but also because the penalty was imposed even though the Agency described the number of California opt-out requests as only a “mere handful.”

While LocateSmarter LLC allegedly was not timely registered as a data broker, even registered data brokers have reportedly received similarly few requests from Californians, raising questions about whether the first enforcement action reflects widespread consumer engagement or, instead, the CPPA’s willingness to enforce technical compliance obligations even where consumer request volume remains modest.

Why aren’t Californians submitting more requests?

While the CPPA has been promoting its Delete Request and Opt-Out Platform, or DROP, as a simpler way for residents to send one request to hundreds of registered data brokers rather than contacting each company individually, it appears that many registered data brokers are receiving few requests. Bloomberg Law recently reported that close to 150 registered data brokers, roughly a quarter of the approximately 570 firms on California’s data broker registry, reported receiving no deletion requests from Californians, while many others reported receiving relatively few requests at all. The CPPA appears to be trying to solve an awareness problem through a statewide “roadshow” this spring which includes setting up booths at local farmers markets and community events.

But that outreach may also reveal a disconnect between how regulators define data brokers and how consumers think about protecting their data. When many Californians think about companies collecting, monetizing, or sharing personal information, they may think first of the major technology companies headquartered in California, not lesser-known entities operating behind the scenes. A consumer who visits the data broker registry expecting to find the household-name platforms, such as Meta and Google, that shape online search, advertising, social media, and digital commerce may therefore be surprised to find that those companies are not necessarily listed there.

While DROP may increase consumer engagement with that category, it raises the question about whether the companies consumers most associate with data monetization are the same companies California’s data broker rules are most likely to reach.

Why aren’t these big tech companies on the registry?

That question is complicated by the gap between how companies describe data monetization and how California privacy law defines a “sale.” Large Tech companies such as Google may insist that they do not “sell” personal information in the ordinary, cash-for-data sense, even while they monetize user data through targeted advertising, audience profiling, real-time bidding, and related AdTech systems. But under the CCPA, a “sale” is not limited to a direct exchange of data for cash; it can include making personal information available to another business or third party for monetary or other valuable consideration.

That broader definition makes the familiar “we do not sell your data” statement found on these company’s websites less straightforward. The separate question is why a major technology platform may not appear on California’s data broker registry even if its business depends heavily on data-driven advertising. One answer may lie in the data broker statute itself, which generally focuses on businesses that knowingly sell personal information about consumers with whom they do not have a direct relationship. Large consumer-facing platforms, by contrast, often collect information directly from users through accounts, products, or services, and may characterize downstream advertising disclosures as part of an advertising service rather than the sale of consumer profiles. That distinction does not necessarily place Big Tech beyond the reach of the CCPA, but it may help explain why the CPPA’s data broker enforcement has started elsewhere.

For more information, please contact Fredrick Hagen at fred.hagan@fmglaw.com and Kayli Clifford at kayli.clifford@fmglaw.com or your local FMG Law attorney.

Information conveyed herein should not be construed as legal advice or represent any specific or binding policy or procedure of any organization. Information provided is for educational purposes only. These materials are written in a general format and not intended to be advice applicable to any specific circumstance. Legal opinions may vary when based on subtle factual distinctions. All rights reserved. No part of this presentation may be reproduced, published or posted without the written permission of Freeman Mathis & Gary, LLP.