When Opt-Out Asks for Your SSN Last Four: Lessons from CalPrivacy’s LocateSmarter Order

California’s privacy regulator went after a data broker — and published lessons every SMB that sells or shares customer data should read.

Foundations · Philosophy

James Venuto · Security Medic Consulting, LLC - AI Cyber Security and Privacy · September 23, 2026 · 9 min read

If you only skim headlines, LocateSmarter looks like “another data broker fine.” That would be a miss. On August 11, 2026, the California Privacy Protection Agency (CalPrivacy) announced its first action against a data broker under both the California Consumer Privacy Act (CCPA) and the Delete Act — and the order’s practical lessons travel far beyond the broker industry.

LocateSmarter, LLC was ordered to pay $116,490: $79,890 under the CCPA, $30,600 under the Delete Act, plus a $6,000 registration fee. Among the CCPA findings: the firm required consumers to submit their full name, mailing address, and the last four digits of a Social Security number to opt out of the sale of personal information. CalPrivacy treated that as unlawful friction and a data-minimization failure.

SMB translation: If your “Do Not Sell/Share” form asks for sensitive identifiers you do not need to complete the request — or makes opt-out harder than signing up — you are copying the pattern regulators just punished. You do not need to be a data broker to get this wrong.

What CalPrivacy Emphasized

Dual statutes, one action. LocateSmarter was treated as both a data broker under the Delete Act and a business under the CCPA.
Opt-out is not a “verifiable consumer request.” Unlike delete/know/correct, sale/sharing opt-outs generally should not require identity verification that collects sensitive personal information when lighter identifiers work.
Data minimization applies to the request itself. Ask only what is reasonably necessary and proportionate to complete the opt-out.
Low volume can be evidence of friction. Few opt-outs is not automatically a clean bill of health; a regulator may read it as proof the process blocked people.
Training is not optional theater. Personnel who handle consumer privacy requests must be informed of CCPA requirements; the order required updated training confirmation.

Why This Hits Ordinary SMBs

Retailers, SaaS companies, agencies, clinics’ marketing stacks, and professional-services firms often sell or share personal information through ad tech, list partners, or analytics. California residents among your customers bring CCPA expectations even when you never call yourself a broker. The Delete Act registration angle is broker-specific; the opt-out friction and minimization lessons are not.

A Practical Checklist This Month

Walk your own opt-out form. Time the clicks. List every field. Strike anything not needed to identify the consumer for sale/sharing opt-out.
Ban sensitive PI as a default opt-out ask. SSN fragments, full government IDs, and similar — unless counsel has a documented, necessary reason — are a red flag after LocateSmarter.
Measure stop-sale timelines. CCPA expectations include acting as soon as feasible and no later than 15 business days, and notifying relevant third parties.
Train the humans who answer the inbox. Document who handles privacy requests and that they know how to direct consumers to rights.
Inventory sale/share pathways. Ads, clean rooms, list rentals, and “partners” — if you cannot name them, you cannot honor an opt-out.

This week’s action: Screenshot your public opt-out / Do Not Sell page. Circle every required field. If any field collects sensitive personal information, escalate to counsel or your privacy lead the same day with LocateSmarter as the reason.

Soft Next Step

If you want a calm review of opt-out flows, sale/share inventory, and training notes — without a privacy theater binder — Privacy Medic / Security Medic can help Hudson Valley and regional SMBs close the gaps CalPrivacy just spotlighted.

References

CalPrivacy, “CalPrivacy Brings First Action Against a Data Broker Under Both the CCPA and Delete Act” (Aug 11, 2026): privacy.ca.gov/…
CalPrivacy, LocateSmarter, LLC case page: privacy.ca.gov/2026/08/locatesmarter-llc/
Order of Decision and Stipulated Final Order, In re LocateSmarter, LLC (Aug 10, 2026): Order PDF
InfoLawGroup, “Practical Lessons for All Businesses From a Recent CalPrivacy Action” (Aug 24, 2026): infolawgroup.com/…