The $17 Million Lesson: California's Privacy Police Are Targeting Your Opt-Out Button

This week, the agency that enforces California's privacy law wants you to think about the data brokers you have never heard of. CalPrivacy on October 12, 2026 launched its first Delete Week, a statewide awareness push through October 16 highlighting the state's free Delete Request and Opt-out Platform, known as DROP. As of mid-October 2026, more than 560,000 Californians have registered on the platform, and the agency says brokers have reported deleting nearly 100 million consumer profiles.

The campaign arrives in the middle of the most aggressive year of privacy enforcement in California history. An analysis by privacy software company Clym of all 14 settlements announced under the California Consumer Privacy Act since the program's first case in 2022 found that regulators have announced more consumer privacy penalties this year than in all earlier years combined: five settlements in 2026 totaling $17.1 million, compared with $7.9 million across the nine settlements announced from 2022 through 2025.

The opt-out button is the whole story

Look past the record total and one failure dominates the docket. In 12 of the 14 settlements Clym reviewed, regulators cited how a business handled requests to opt out of the sale or sharing of personal data, making opt-outs by far the most common issue since enforcement began. Any covered business that sells or shares the personal data of California visitors has to offer a working opt-out and honor it. As of October 2026, the law allows fines of up to $2,663 per violation, or $7,988 for each intentional violation.

The examples are strikingly ordinary. General Motors paid $12.75 million in the largest CCPA penalty on record, announced May 8: state officials said the automaker sold the names, contact information, location, and driving data of hundreds of thousands of Californians to data brokers without giving notice. Mobile game maker Jam City had no compliant opt-out in any of its 21 apps. Clothing retailer Todd Snyder left its opt-out request page broken for 40 days and required identity verification to use it. Ford paid $375,703 in March after CalPrivacy found it required an extra email verification step before processing an opt-out. Honda's $632,500 settlement centered on a cookie banner that took two clicks to decline tracking but only one to accept it. Several companies also ignored Global Privacy Control, the browser setting that sends an opt-out signal automatically, an issue regulators have flagged since the first settlement in 2022, and one case involved a mobile game that collected and shared kids' information without parental consent.

The opt-out button has become the single most important piece of user interface in American privacy law, and in case after case, California's regulators have found it broken, buried, or missing entirely.

The Delete Act's machinery is finally running

Alongside the CCPA fines, California is building enforcement infrastructure that no other state has. The Delete Act, enacted in October 2023, requires data brokers to register annually with CalPrivacy and pay a registration fee, with fines of $200 per day for missing the January 31 deadline. DROP, the law's centerpiece, became fully operational on August 1, 2026: it is the first mechanism of its kind, letting consumers submit a single deletion request that goes to every registered broker, more than 660 of them as of this fall. Brokers must check the platform at least once every 45 days and process those requests, or face fines of $200 per deletion request per day.

CalPrivacy is using the stick, not just the carrot. In November 2025 it created a dedicated Data Broker Enforcement Strike Force, and as of fall 2026 it has announced more than a dozen actions against brokers that failed to register. In August 2026, the agency ordered Iowa data broker LocateSmarter to stop demanding mailing addresses and the last four digits of Social Security numbers from consumers who wanted to opt out of the sale of their data, a practice the agency found unlawful under the CCPA. On September 1, CalPrivacy fined SalesIntel $36,400 for failing to register; the unregistered broker's database holds more than 200 million professional contacts and 54 million U.S. mobile numbers. "This ongoing enforcement activity shows that CalPrivacy takes seriously the failure to register by the deadline," Executive Director Tom Kemp said.

The national picture is getting bigger

The California pattern is part of a national surge. A Privado AI report published October 5, 2026 projects U.S. companies will pay $1.4 billion in privacy settlements over web and app tracking, up 36 percent from 2025. Of the settlements the report analyzed, healthcare companies account for 64 percent, technology companies pay the most on average at $26.8 million, and Meta's advertising pixel is named in 91 percent of settlements that named a third-party tracker. Cases involving app tracking pay 3.5 times more on average than website-only cases. Separately, security research published in September 2026 found a cookie set by OpenAI recording free-tier ChatGPT users' activity across more than 1,000 merchant websites, a tracker OpenAI's cookie policy classifies as analytics rather than marketing.

California also just rewrote one corner of the litigation map. SB 690, signed on September 30, 2026 and set to take effect January 1, 2027, stops tracking claims under one provision of the California Invasion of Privacy Act, Section 638.51; only 3 percent of the 116 settlements Privado AI reviewed relied on that provision. The reform leaves intact the wiretapping provision, Section 631, which 88 percent of CIPA-citing settlements relied on. The enforcement-culture shift is visible in Washington too: the Federal Trade Commission's 2026-2030 strategic plan names privacy and data security among its top goals, and the agency is heading toward its antitrust trial against Amazon in March 2027.

What comes next

Regulators say the fines are only going up. In remarks reported in April 2026, CalPrivacy's head of enforcement, Michael Macko, warned that fines under the law "could become a cost of doing business if they're not higher" and called the size of fines "an area to watch." The record $12.75 million settlement was announced five weeks later. CalPrivacy, the newer of the two enforcing agencies, has brought six of the 14 CCPA settlements so far, and the docket points toward more actions against ordinary businesses, not just household names: retailers, restaurants, medical offices, and app makers all run the websites and apps these cases involved.

The model is also starting to travel. DROP's single-request deletion machinery is the first of its kind, and as of October 14, 2026 it is the closest thing America has to a national do-not-track list for data brokers, a voluntary one that reaches only brokers registered in California. Other states have copied California's privacy statutes for years, and they are likely to copy the enforcement machinery next. And January 1, 2027 brings the SB 690 change, which will test whether narrowing one litigation theory slows the $1.4 billion settlement machine or merely shifts lawyers toward the wiretapping claims that remain. None of this is legal advice: rules and deadlines are changing fast, so check specifics against current CalPrivacy guidance and counsel. But the direction is unmistakable. For two decades, online privacy was governed by promises. As of October 2026, in California at least, it is governed by penalties.