Research · October 11, 2026 · 4 min read

California is fining data brokers. What that tells Canadians

California’s privacy regulator has shut down one people-search site and fined a string of data brokers since 2025. What they did wrong, and what it means if you live in Canada.

BBrody · Frame

Data brokers rarely face consequences you can see. California has been the exception. Since early 2025, its privacy regulator, now called CalPrivacy, has brought more than a dozen enforcement actions against data brokers. The cases are small in dollars, but they show clearly what regulators expect, and they’re a useful yardstick for Canadians.

The cases

California’s Delete Act requires data brokers to register with the state every January and pay a fee. That fee funds a public registry and DROP, a tool that lets Californians ask every registered broker to delete their data in one request. DROP opened to Californians in January 2026, and brokers began processing requests in August 2026. Most of the cases so far are about brokers that didn’t register.

Background Alert (February 2025). A people-search site that, in the regulator’s words, advertised that “it’s scary how much information you can dig up on someone.” To settle, it agreed to shut down its data broker operations through 2028, or pay a $50,000 fine.
Datamasters and S&P Global (January 2026). Datamasters, a Texas reseller of personal information for targeted advertising, was fined $45,000 and ordered to stop selling Californians’ personal information. CalPrivacy later described the case as stopping the sale of lists of Californians with Alzheimer’s disease and other health conditions. S&P Global was fined $62,600 for failing to register because of what it called an administrative error.
LocateSmarter (August 2026). The largest so far: $116,490. Besides registering late, the company required people to give the last four digits of their Social Security number before it would let them opt out. The regulator said that asking for unnecessary data can intimidate people and violates California’s data minimization rules.
Cybba and SalesIntel Research (August and September 2026). Fines of $52,400 and $36,400 for missing the 2025 registration deadline. Both must now process deletion requests through DROP.

In September 2026, the regulator also warned brokers that wrong information in their registration can cost $200 for each day it stays on the registry.

(All amounts are in US dollars.)

What it means if you live in Canada

DROP is only for California residents. Canada has no data broker registry, and no single request that reaches every broker. Under PIPEDA you can still ask a broker what it holds about you and withdraw your consent, and in Quebec, Law 25 lets you require a business to stop publishing information about you in some cases. That’s one company at a time. Our guide to opting out of data brokers in Canada walks through how.

The California cases are still useful here, for three reasons:

They name the patterns. Selling sensitive health lists, building profiles from inferences, and making opt-outs hard are the practices regulators are treating as harmful.
They set a standard for opt-outs. If a broker asks for far more than it needs to find your record before it will remove you, that’s the behaviour California fined. Give the minimum. Your name, the listing’s URL and an email address are usually enough.
They show what a registry makes possible. Most of these cases started with a simple question: did you register? Without a list of who the brokers are, nobody can ask it. As Canada debates its own privacy reform, Bill C-36, that’s a fair point to raise with your MP.

Sources

California Privacy Protection Agency, Data Broker Promoting Ability to Dig Up “Scary” Amounts of Information Agrees to Shut Down, February 27, 2025
California Privacy Protection Agency, CalPrivacy Brings New Round of Enforcement Actions Against Data Brokers, January 8, 2026
California Privacy Protection Agency, CalPrivacy Brings First Action Against a Data Broker Under Both the CCPA and Delete Act, August 11, 2026
California Privacy Protection Agency, CalPrivacy Announces Second Data Broker Enforcement Action in Less than a Week, August 13, 2026
California Privacy Protection Agency, CalPrivacy Continues Enforcement Blitz with Action Against Virginia Data Broker, September 1, 2026
California Privacy Protection Agency, Enforcement Advisory Targets Incorrect Information in Data Broker Registration, September 3, 2026
California Privacy Protection Agency, About DROP and the Delete Act

New posts, by email.

About once a month. Plain-language privacy notes, nothing else. I never share your address.

The cases

Background Alert (February 2025). A people-search site that, in the regulator’s words, advertised that “it’s scary how much information you can dig up on someone.” To settle, it agreed to shut down its data broker operations through 2028, or pay a $50,000 fine.

Datamasters and S&P Global (January 2026). Datamasters, a Texas reseller of personal information for targeted advertising, was fined $45,000 and ordered to stop selling Californians’ personal information. CalPrivacy later described the case as stopping the sale of lists of Californians with Alzheimer’s disease and other health conditions. S&P Global was fined $62,600 for failing to register because of what it called an administrative error.

LocateSmarter (August 2026). The largest so far: $116,490. Besides registering late, the company required people to give the last four digits of their Social Security number before it would let them opt out. The regulator said that asking for unnecessary data can intimidate people and violates California’s data minimization rules.

Cybba and SalesIntel Research (August and September 2026). Fines of $52,400 and $36,400 for missing the 2025 registration deadline. Both must now process deletion requests through DROP.

In September 2026, the regulator also warned brokers that wrong information in their registration can cost $200 for each day it stays on the registry.

(All amounts are in US dollars.)

What it means if you live in Canada

The California cases are still useful here, for three reasons:

They name the patterns. Selling sensitive health lists, building profiles from inferences, and making opt-outs hard are the practices regulators are treating as harmful.

They set a standard for opt-outs. If a broker asks for far more than it needs to find your record before it will remove you, that’s the behaviour California fined. Give the minimum. Your name, the listing’s URL and an email address are usually enough.

They show what a registry makes possible. Most of these cases started with a simple question: did you register? Without a list of who the brokers are, nobody can ask it. As Canada debates its own privacy reform, Bill C-36, that’s a fair point to raise with your MP.