LocateSmarter data broker fine: did they sell your Social Security number?

On August 11, 2026, the California Privacy Protection Agency announced an order — signed the day before and effective immediately — requiring Iowa-based LocateSmarter LLC to pay $116,490 and change its practices. That total is a $30,600 fine for missing the January 31, 2026 data-broker registration deadline (covering 2025 activity), a $6,000 registration fee, and a $79,890 fine under California’s consumer privacy law. LocateSmarter admitted the facts. Officials called this the first enforcement action against a data broker under that privacy law, and the first under both that law and the Delete Act.

The agency found the company collected personal information, in part through licensing agreements, and sold it without timely registration. The information included names, dates of birth, Social Security numbers, telephone numbers, email addresses, employment information, driver’s license information, bankruptcy and litigation records, and inferences such as whether someone is “litigious.” Its opt-out form asked Californians for a full name, mailing address, and the last four digits of a Social Security number. Only a mere handful of people submitted requests. The order does not say how many people had their information collected or sold.

Nobody hacked them. They were already selling the file.

Most coverage leads with “historic first fine” and a missed registration deadline. That is the regulator’s story. It is not the part that changes anything for you.

LocateSmarter is a data broker. You almost certainly never opened an account with them. They assemble records from other companies and sell them. California’s order is about skipped paperwork and a hostile opt-out form — not about whether those dossiers existed. They did. The company has already admitted it sold them. A Social Security number and a court-record flag were not a side effect of this case. They were the product.

The reason almost nobody opted out is not that people were fine with this. The form asked you to hand the same company your home address and part of your Social Security number before it would stop. That is the opposite of an exit. Write-ups that treat “a handful of requests” as a small problem are reading the number backwards.

There is also no public roster of whose records were in those files, and no official count of people affected. A clean result on a people-search site or a “have I been breached” check does not mean you were absent. Those tools do not search this broker’s customers, and no one can truthfully run that check for you.

What to actually expect

• You should not expect a letter or email telling you whether LocateSmarter had a file on you. The official order does not require individual notices, and it never states how many people were involved.
• From the August 10, 2026 order onward, the company must register, process California deletion requests through the state’s DROP system, and stop demanding extra identity details — including a Social Security number fragment — just to opt out.
• Anyone who already bought a file from LocateSmarter still has it. The order does not take those copies back.
• This is an enforcement case, not a report of a stolen database posted online. Unexpected credit or tax activity is still worth a look, because the data types here are the ones used for new accounts — but do not assume a new dark-web dump appeared under this company’s name.

What you can and cannot fix

If LocateSmarter collected and sold a record that included your Social Security number, driver’s license information, or court history, those copies are already in other companies’ hands. That cannot be undone. A national ID number that was sold is out. No opt-out, deletion request, or removal service can recall a file that was already sold.

What still helps, in order:

• Freeze your credit with Equifax, Experian, and TransUnion. A freeze is one of the few steps that actually blocks new accounts if a buyer has your name, date of birth, and Social Security number. It is free, and you can lift it when you need credit.
• If you live in California, use the state’s Delete Request and Opt-out Platform (DROP). Registered data brokers — LocateSmarter must now be one of them — are then told to delete what they still hold and stop selling it. That does not erase copies already sold. It does cut this broker, and others like it, out of the next round.
• Take down or suppress your listings on people-search sites. A sold record becomes much more dangerous when it can be joined to public pages that add relatives, phone numbers, employers, and old addresses. Those listings, unlike the copies LocateSmarter already sold, can actually be removed.
• Be slow to trust any message that mentions this company and asks you to “verify” yourself. The original opt-out form already trained people to hand over more identity. Scammers copy that pattern.