The background-check law wasn't the one to worry about. This one is.

Sometimes. Skip tracing done as FCRA-regulated background screening is carved out of California's data broker definition. Skip tracing sold to process servers, real estate investors, or marketing operations outside FCRA, about people the seller has no direct relationship with, is squarely inside it: California's Delete Act (Civ. Code Section 1798.99.80) defines a data broker as a business that knowingly sells personal information about consumers it has no direct relationship with. Whether that reaches a specific shop is a question for that shop's own counsel, not this page.

On August 11, 2026, California's privacy regulator, CalPrivacy, announced its first enforcement action ever to cite both the Delete Act and the CCPA together. The target was LocateSmarter, LLC, a skip-tracing and location-data company that sells batch skip-tracing products. The order breaks down into three pieces:

• $30,600 for missing the January 31, 2026 deadline to register as a California data broker.
• $79,890 for asking consumers for a full name, the last four digits of a Social Security number, and a mailing address just to submit an opt-out request. The regulator's own data-minimization rule, Civ. Code Section 1798.199.55, calls that too much to ask for a simple opt-out.
• $6,000 to finally pay the registration fee it should have paid in January.

It's worth being precise about what this case is and isn't. It's the first action combining both laws. It is not, as of today, a fine for mishandling the recurring 45-day deletion cycle itself, and no such fine has ever been assessed against anyone. The registration-and-opt-out-form problems are what got LocateSmarter caught. We'd rather tell you that plainly than oversell it.

LocateSmarter isn't the first firm in this line of work to get hit. In February 2025, CalPrivacy forced Background Alert, a people-search site, to shut down entirely through 2028 or pay $50,000, over the same failure to register. Read the full enforcement record, including what a paper trail would have changed in each case.

None of this is a claim about your shop specifically. We don't know your legal status, and it isn't ours to determine, that's a question for your counsel. What's public record is what the regulator has actually done to firms doing this kind of work, and what the statute says categorically. The next section covers both.

Sources: CalPrivacy stipulated order, Aug 10, 2026 and CalPrivacy's announcement, Aug 11, 2026.

Start with the carve-out, because it filters out a lot of skip-trace work fast. If what you do is FCRA-regulated consumer reporting, a permissible-purpose background check under the federal Fair Credit Reporting Act, that data is excluded from the Delete Act's data broker definition, to that extent. If your business runs entirely through FCRA, this law is mostly not aimed at you.

If it doesn't, keep reading. California's Delete Act (Civ. Code Section 1798.99.80) defines a data broker, broadly, as a business that knowingly sells personal information to third parties about consumers it has no direct relationship with, information it didn't collect from those people itself. That's the statute's language, not a diagnosis of your business. Only your counsel can tell you whether it fits.

In practice, the skip-trace work most exposed to that definition sits outside FCRA entirely: batch location and contact lookups sold to process servers, real estate wholesalers and investors, marketing operations, or non-FCRA collections support. That's the same category of business LocateSmarter and Background Alert were in.

One more thing worth knowing before you talk to your lawyer: a lot of skip-trace shops lean on the statute's fraud-prevention exemption to deny deletion requests, without ever writing down the reasoning anywhere. Exemptions are self-adjudicated, the statute lets a broker make that call, but they aren't self-documenting. California's draft audit rules (new Article 5, Sections 7630 to 7633, not yet adopted) would require the first independent audit report by November 1, 2028, covering everything from August 1, 2026 forward. An exemption claim with nothing behind it today is exactly the kind of record that reads badly in that audit.

Six questions, three minutes, and it runs entirely in your browser: take the self-test. Or skip straight to your lawyer; that's always the right call for an actual determination.