LocateSmarter Priced Your Opt-Out at 4 SSN Digits

Introduction

LocateSmarter's own privacy policy states the rule correctly: "A request to opt-out need not be a verifiable consumer request." The form the company actually ran demanded the last four digits of your Social Security number and your mailing address before it would stop selling your file to debt collectors and background-check firms. California's privacy regulator hit LocateSmarter with $116,490 in fines and fees on August 10, most of it over that form. The broker is a subsidiary of CBE Companies, a Cedar Falls, Iowa debt-collection conglomerate that built it in 2014 and still shares an address with it.

A Debt Collector Built Its Own Data Supplier

CBE was not coy about the arrangement. "LocateSmarter will operate as a separate legal entity under CBE Companies," Chad Benson, then CBE's president and COO, said in the May 2014 announcement forming it. The new arm sold location and contact data into the accounts-receivable and skip-tracing industry: collection agencies, background-screening firms, consumer reporting agencies, auto-repossession operators. CBE's flagship subsidiary, The CBE Group, is one of only three private agencies the IRS authorizes to collect federal tax debt, and consumers have filed 4,655 complaints against it in the CFPB's public database, 994 of those in 2025.

The CPPA's order lists what LocateSmarter sold about people it had no relationship with: names, dates of birth, Social Security numbers, addresses, phone numbers, employment and driver's license information, bankruptcy and litigation records. One product, a "WebRecon Litigious Scrub," flags consumers as litigious based on past lawsuits. Selling all of it made LocateSmarter a data broker under the Delete Act, which required it to register with the state by January 31, 2026. It didn't.

The order records how well the opt-out form worked. Out of a state of nearly 40 million people, "a mere handful" ever submitted a request asking LocateSmarter to stop selling their information. Almost nobody opts out, which means the file stays whole, exactly what LocateSmarter's clients are paying for.

Inside the Form That Asked for Four Digits

California's rules don't bar a company from asking questions. A business may ask for what it needs to locate your record; it may not make you prove your identity first, because an opt-out isn't a "verifiable consumer request" under the CCPA, the rule LocateSmarter's own policy page already spelled out. The order's finding: the company reached for the most sensitive identifier available when ordinary ones would have found the same record: "By requiring consumers to submit their mailing address and part of their Social Security number, LocateSmarter unlawfully required consumers to provide more information than necessary."

CPPA had warned the industry about this specific move two years earlier. Its first enforcement advisory, from April 2024, told businesses to stop collecting Social Security numbers and driver's license numbers for consumer requests unless verification genuinely required them. The required "Last 4 Digits of my Social Security Number" field was still sitting on LocateSmarter's opt-out page in the Internet Archive's June 8, 2026 capture, two years after that advisory and four months past the registration deadline the company also blew.

Where the form stands today: the SSN field is gone from the standard opt-out path, removed sometime between that June 8 capture and now, with no later snapshot to narrow the window and nothing tying it to the order. A mailing address is still required from everyone, under a section still headed "VERIFICATION INFORMATION," and a parent opting a child out is still asked for the child's last four SSN digits. LocateSmarter has until roughly October 9 to finish those changes, so none of it is a violation yet.

$79,890 Divided by $2,663

The $116,490 breaks into $30,600 for registering late under the Delete Act, $79,890 for the opt-out violations under the CCPA, and a $6,000 annual registration fee the company owed anyway.

The smaller half runs on the meter written into the statute. Late data-broker registration costs $200 a day, and $30,600 buys exactly 153 of them. The larger half doesn't track days at all. Divide it by $2,663, the CCPA's per-violation fine ceiling since the January 1, 2025 inflation adjustment, and it lands on exactly 30. Nothing else divides cleanly: the pre-adjustment $2,500 base gives 31.96, and the $7,988 intentional-violation ceiling misses ten by $10.

That's the part that stopped me. Thirty violations, each priced at the statutory maximum, in a settlement the company negotiated and signed rather than contest. The order doesn't say any of that. It gives two dollar figures and the code sections behind them, with no violation count and no mention of $2,663 in its sixteen pages. The division is mine.

Who Benefits

CBE Companies. LocateSmarter has to register, pay, retrain its staff, rebuild the form, and start processing deletion requests through California's platform. It doesn't have to stop selling Californians' data, and nothing in the order reaches the files it already sold to background-check and collection clients. Four days after the order, the site was still up and still advertising the same product lines.

CBE is privately held and files no audited financials, so there's no honest way to say what share of revenue the fine represents. The structure holds without one: a debt-collection parent keeps the data supplier it built for its own industry, the subsidiary keeps its client list, and the whole episode costs a payment and a form redesign. Whatever the SSN gate saved in opt-out requests nobody ever filed, the company keeps.

Sacramento collects something too. The Governor's office posted on August 13 that California "cracked down on data broker LocateSmarter" under "Governor Newsom's signature data broker privacy law," citing the 475,000-plus deletion requests Californians have filed through the state platform. CPPA, a board Newsom doesn't sit on, decided the case.

What $116,490 Doesn't Buy Californians

Set that against January's case against Rickenbacher Data LLC, which does business as Datamasters: a $45,000 fine for a registration failure, plus an order to stop selling Californians' personal information altogether. LocateSmarter pays more than two and a half times as much and keeps selling.

CPPA's recent list runs much bigger: General Motors at $12.75 million, Ford at $375,703 for opt-out friction of its own. Executive Director Tom Kemp says the board "imposes a substantial fine even though a mere handful of consumers submitted requests to opt out," which prices the friction, not the number of opt-out requests it drew.

The Bottom Line

The fine buys Californians a fixed opt-out form at one small Iowa company, due by early October. It requires LocateSmarter to recall nothing it already sold, and to tell nobody in those files that they were in them.

Every other broker on California's registry can run the same arithmetic now: thirty violations at the ceiling came to $79,890, and deleting a field from a web form takes an afternoon. The open question is how many of them quietly do it before CPPA's strike force reads their forms, and whether the next order asks for anything about the data that already changed hands.