Internet privacy updates: CalPrivacy fines data brokers, Colorado proposes new AI regulations

The Data Protection Report says that on August 10, CalPrivacy announced an order against an Iowa data broker, LocateSmarter, LLC[1]. The outlet reports that the company required consumers wishing to opt out of the sale or sharing of their personal data to submit[1] their mailing addresses and the last four digits of their Social Security numbers.CalPrivacy said in a statement that LocateSmarter must pay $116,490 and change its practices[2]. The agency said this is the first to arise under both the CCPA and the Delete Act[2]. Executive director Tom Kemp said the fine was "substantial... even though a mere handful of consumers submitted requests to opt out"[2].According to the Data Protection Report, on August 13, CalPrivacy announced another order, this time against a Massachusetts data broker, Cybba Inc.[1] The outlet says Cybba must pay a $52,400 fine plus the data broker registration fee[1]. It adds that a third broker, Virginia-based SalesIntel Research, agreed to pay a fine of $36,400[1].Wiley reports that on August 11, 2026, Colorado released proposed rules[3] for its revised AI law, the ADMT Act, and for its Chatbot Safety Act. The firm says the rules will go into effect January 1, 2027[3] once they are finalised.Seyfarth Shaw says the proposals point to a need for "significant infrastructure, including decision-level explainability, data-source traceability, staffed human-review processes, and chatbot safety reporting"[4]. According to the Colorado Attorney General's office, written comments can be submitted between August 11, 2026, and October 26, 2026[5].