Data Brokers Beware: California Settlement Highlights Risks in High-Friction Opt-Out Processes

The useful part

California's privacy regulator just sent a clear message to the data broker ecosystem: compliance failures will be viewed across both the California Consumer Privacy Act (CCPA) and the Delete Act. Agency (CPPA) announced a $116,490 settlement with LocateSmarter LLC, an Iowa-based company that allegedly operated as a data broker without registering as one. LocateSmarter made it too difficult for consumers to opt out of the sale of their personal information by requiring them to provide the last four digits of their Social Security numbers before submitting an opt-out request.

How it works

• According to the CPPA, LocateSmarter collected sensitive and high-risk data, including names, driver's license information, dates of birth, and information about employment, bankruptcy, and litigation.
• The takeaway for companies that are data brokers, or those that may fall within California's broad data broker definition, is practical and immediate.
• The CPPA's order emphasized that requiring consumers to provide more personal information than necessary, particularly sensitive information, can violate California's data minimization requirements and...
• Third, low opt-out volumes should not be viewed as a compliance success story if the request process is confusing, intimidating, or overly burdensome.
• California regulators are increasingly looking at privacy practices through multiple lega...

Details worth keeping

First, companies should reassess whether they are required to register in California, especially if they buy, sell, license, trade, or otherwise share personal information about consumers with whom they do not have a direct relationship.