California Steps Up Privacy Enforcement with New Data Broker and Tracking Rules

California takes historic actions enforcing data deletion and tracking privacy laws.

California has intensified its privacy enforcement landscape with significant new regulatory measures targeting data brokers and website tracking practices. On August 13, 2026, the state filed its first enforcement action under the Delete Act against Iowa-based LocateSmarter LLC for failing to register as a data broker and unlawfully demanding sensitive information from Californians before opting out of data sales. The Delete Act, operational since January 1, 2026, enables consumers to submit a single deletion request through the Delete Request and Opt-Out Platform (DROP), a requirement data brokers had to comply with starting August 1, 2026. As of August, 475,000 Californians have used DROP to request data deletion.

Further tightening privacy rules, the California Legislature passed SB 690 on August 28, 2026. This law restricts private rights of action under the California Invasion of Privacy Act (CIPA) in lawsuits based on pen register and trap-and-trace device theories concerning website tracking. It applies retroactively, affecting numerous ongoing cases, at a time when CIPA tracking lawsuits surged from about 600 to nearly 4,000.

Adding to the enforcement framework, California is mandating that all major browsers incorporate Global Privacy Control (GPC) signals by January 1, 2027, allowing users to communicate their data opt-out preferences automatically to websites. This aligns with existing California Consumer Privacy Act (CCPA) rights granting consumers the ability to opt out of personal data sales, including via GPC signals.

Governor Gavin Newsom emphasized the state's commitment, stating, "Californians should have control over their personal data — not data brokers. Our nation-leading effort... empowers people to take ownership of their data." Meanwhile, privacy experts Lael Bellamy and Joyce Kim noted that many violations arise from companies using nonfunctional privacy tech tools that fail to block actual data tracking.

Recent enforcement has proven costly: in 2025 and 2026, the California Privacy Protection Agency settled cases imposing over $3.4 million in fines on companies including Honda and Tractor Supply for CCPA infractions. CalPrivacy’s cooperation with multiple states’ Attorneys General and international regulators further signals a coordinated push toward robust privacy compliance. Legal tech and other businesses operating in California must reassess compliance strategies urgently to manage elevated risks from these enhanced enforcement actions.

Yes, but: While SB 690 limits private lawsuits under CIPA, it applies retroactively and thus does not eliminate existing enforcement pressures from state agencies like CalPrivacy.

What's next: From January 1, 2027, major browsers must support Global Privacy Control signals, increasing automation of consumer opt-outs under CCPA.