Enforcement tracker

Every fine issued so far

California has penalised at least fourteen companies under the Delete Act. Two patterns matter, and both should worry you more than the numbers.

Pattern one: nobody was hiding

These are not shell companies. They include a B2B prospecting tool, a data-append service, a marketing agency, and a large financial-information company that called its violation an administrative error. Most did not think of themselves as data brokers.

Pattern two: none of these were for deletion

Every action so far punished paperwork — failing to register, or over-collecting during an opt-out. The deletion requirement only began in August 2026, so the first 45-day windows are closing now. That wave has not landed yet.

AmountDateCompany & what happened
$52,400
13 Aug 2026Cybba, Inc.

Sold location data, browsing activity, and inferences about people it had no direct relationship with, without registering. Described by the regulator as the fourteenth company penalised for failing to register.

$110,490
11 Aug 2026LocateSmarter, LLC

The largest to date, and the first action brought under both the CCPA and the Delete Act together. Two failures: not registering, and demanding a person's full name, mailing address and the last four digits of their Social Security number just to process an opt-out. Asking for more identification than you need is itself a violation.

$62,600
8 Jan 2026S&P Global, Inc.

Failed to register. The company characterised it as an administrative error — which is precisely the point: this is not a rule you can fail only by intending to.

$45,000
as reported
8 Jan 2026Rickenbacher Data (Datamasters)

A Texas list reseller selling demographic and health-condition lists without registering.

$56,600
as reported
Dec 2025ROR Partners, LLC

A Nevada marketing firm — penalty plus unpaid registration fees.

$55,800
as reported
2025Key Marketing Advantage

Operated unregistered for most of a year before being caught.

$55,400
as reported
2025Accurate Append

Missed the January registration deadline. Data-append services are squarely in scope — appending is the definition of holding data on people who never dealt with you.

Shut down until 2028
Feb 2025Background Alert, Inc.

Not a fine. Ordered to cease operating entirely for three years, or pay $50,000. The regulator can end a business, not just invoice it.

$35,400
Nov 2024Growbots, Inc.

A B2B sales-prospecting tool. If your product sells contact data, you are a data broker regardless of what you call yourself.

$34,400
Nov 2024UpLead LLC

Also B2B contact data. Registered late, after roughly six months unregistered.

Amounts and dates as publicly announced by the California Privacy Protection Agency. Figures marked "as reported" have varied slightly between sources — verify against the agency's own announcements before relying on a specific number. Last updated 5 September 2026.

What this tells you to do

▪
Register, even if you're unsure

The cheapest fine here is $34,400, and every one of them was avoidable by filling in a form and paying the fee. Registration costs $6,000.

▪
Don't over-ask when someone opts out

LocateSmarter's fine was inflated because it demanded Social Security digits to process a request. Ask for the minimum that verifies the person, and no more.

▪
Assume the deletion wave is next

The regulator has a dedicated enforcement team, a chief auditor, and a nine-point checklist for the audits starting in 2028. The deletion cycle is the obvious next target.

Where do you stand?

Two free checks, no email required: whether the law applies to you, and whether you're on the public registry today.

Am I covered?Search the registryWhat a miss would cost