Internet privacy updates: CalPrivacy fines data brokers, Colorado proposes new AI regulations

What happened

On Aug 10, 2026 CalPrivacy ordered Iowa‑based LocateSmarter, LLC to pay $30,000 for Delete Act violations and $80,000 for CCPA breaches after it demanded consumers' last four SSN digits to opt out. On Aug 13 and Sep 1, CalPrivacy fined Massachusetts‑based Cybba Inc. $52,400 and Virginia‑based SalesIntel Research $36,400 for failing to register as data brokers and required them to post privacy metrics and use the DROP platform. Colorado released a draft AI Act that will take effect on Jan 1, 2027, expanding consumer rights over automated decision‑making technologies.

Why it matters

Data brokers that collect or sell California residents' information must register, avoid requesting SSN fragments, and process deletion requests through the state‑run DROP platform; firms using AI decision tools in Colorado should prepare to disclose ADMT impacts and handle consumer response requests.

Business impact

Non‑compliant brokers face sizable fines and mandatory system changes, while Colorado AI deployers will need new compliance processes before the Jan 2027 effective date.

Checklist

• Register as a data brokerHigh priority

  File the required registration with CalPrivacy for the current year and pay the registration fee.

• Remove SSN requirementsHigh priority

  Cease asking for any portion of Social Security numbers in opt‑out or deletion requests.

• Post privacy‑rights metricsMedium priority

  Publish on your website the number of consumer deletion requests received and fulfilled each quarter.

• Integrate with DROP platformHigh priority

  Connect your systems to CalPrivacy’s Delete Request and Opt‑Out Platform to process future deletion requests.

Who reported it

Discussion