On August 11, the California Privacy Protection Agency (CalPrivacy) announced that its board issued a decision requiring a data broker to pay $116,490 and change its practices after finding that the data broker failed to register timely and unlawfully required Californians to provide partial Social Security numbers before exercising opt-out rights. The agency said the decision was its first against a data broker under the California Consumer Privacy Act (CCPA) and the first to arise under both the CCPA and the Delete Act. CalPrivacy asserted that the data broker collected personal information from third-party sources and sold consumers’ personal information, including names, dates of birth, Social Security numbers, driver’s license information, employment information, and bankruptcy and litigation information, to third parties outside a direct relationship, thereby subjecting it to data broker registration requirements for the 2025 calendar year.

According to the decision, the data broker failed to register by the January 31 deadline and violated the CCPA by requiring consumers to provide their mailing address and part of their Social Security number to submit requests to opt-out of sale or sharing. CalPrivacy found that requiring this information violated the CCPA’s data minimization requirements and prohibition on requiring verifiable consumer requests to opt-out of sale or sharing, and that requiring part of a Social Security number could intimidate consumers from exercising their privacy rights in conflict with the CCPA’s requirement that consumers be able to easily exercise those rights.

The order requires the data broker to: (i) pay a $30,600 administrative fine and $6,000 annual registration fee under the Delete Act; (ii) pay a $79,890 administrative fine under the CCPA; (iii) timely register in future years in which it operates as a data broker; (iv) access and process deletion requests through the agency’s Delete Request and Opt-out Platform; and (v) revise opt-out methods so they are easy, require minimal steps and do not require more information than necessary.