California Just Fined a Data Broker You’ve Never Heard Of. That’s Exactly the Problem.

We’ve written twice now about California’s data broker crackdown — first about the DROP platform itself, then about CalPrivacy’s first combined CCPA-and-Delete-Act enforcement action against a broker that demanded a piece of your Social Security number just to let you opt out. Add a third name to that list, and it may be the one that matters most for anyone who assumes “data broker” only means the people-search sites that turn up when you Google yourself.

A company with 54 million phone numbers you’d never think to check

On August 27, 2026, CalPrivacy finalized a settlement with SalesIntel Research, Inc., a Virginia-based data broker, and made it public the following week as part of what officials are calling an enforcement “blitz.” The fine: $36,400, for the same core violation as the brokers we’ve written about before — SalesIntel never registered with California’s Data Broker Registry by its 2025 deadline.

What makes this one different is what SalesIntel actually does. It isn’t a consumer people-search site. It’s a business-to-business “sales intelligence” platform, and the scale behind it is real: a database of more than 200 million professional contacts, 54 million U.S. mobile phone numbers, and what the industry calls “career-change inferences” — tracking when someone switches jobs, gets promoted, or moves industries, built from signals like professional email domains, job-board activity, and LinkedIn behavior. It also sells website-visitor identification technology: the kind of tool that lets a company figure out who’s browsing its site anonymously and attach a name, email, and phone number to that visit.

None of that shows up when you search your own name on a people-search site. You’d have no way to know SalesIntel had you in its database at all, unless you happened to read a CalPrivacy enforcement notice.

Why this is CalPrivacy’s actual strategy, not a fluke

This is CalPrivacy’s third data broker enforcement action in about a month, and it isn’t random. The agency created a dedicated Data Broker Enforcement Strike Force back on November 19, 2025, specifically to go after registration violations like this one, building on a 2024 sweep that produced its own wave of fines. Michael Macko, the agency’s head of enforcement, used the SalesIntel case to send a message beyond one company: if you’re operating in the AdTech ecosystem — identity resolution, audience targeting, website de-anonymization — go check whether what you’re doing legally counts as being a data broker, because California is looking.

As part of the settlement, SalesIntel now has to register, join DROP so Californians can request deletion through the same one-request system we’ve written about before, and publish its consumer-rights-request metrics publicly.

What the fine actually changes, and what it doesn’t

Here’s the honest part. The fine addresses SalesIntel’s failure to register — it doesn’t erase the data the company has already collected, and it doesn’t retroactively notify the millions of people already sitting in its database. Once SalesIntel is registered and hooked into DROP, a California resident can submit a deletion request and expect it to reach this broker along with every other registered one. But that only works if you know to look. DROP is a single request to every registered broker — it isn’t a way to discover brokers you’ve never heard of in the first place, and a company like SalesIntel, which never markets to consumers at all, is exactly the kind that stays invisible until a regulator’s enforcement notice puts a name to it.

That’s the same limitation we’ve flagged with every DROP-related post so far: the system is only as complete as the registry behind it, and enforcement like this is what keeps new names getting added to that registry rather than sitting outside it indefinitely. We don’t have any confirmed information about whether SalesIntel holds data on any specific person, and we’re not going to guess. What we do know is that the “data broker” category is bigger and less visible than most people assume, and a single request — however well-designed — can’t reach a company nobody’s told you exists. That’s exactly why we keep saying removal isn’t a one-time errand: new brokers keep turning up, and some of them are nowhere near the people-search sites most people picture when they hear the term.

Per-claim source list

1. SalesIntel Research, Inc. fined $36,400 for failing to register as a data broker with California’s Data Broker Registry by the 2025 deadline — privacy.ca.gov, official CPPA/CalPrivacy announcement
2. Settlement decision finalized August 27, 2026; publicized the following week as part of what officials called an “enforcement blitz” (secondary sources give the public announcement date as September 1, 2026) — privacy.ca.gov; corroborated by Captain Compliance, “CalPrivacy Fines SalesIntel $36,400 as California’s Data Broker Enforcement Blitz Accelerates” and Gizmodo, “This Unregistered Data Broker Holds 54 Million Mobile Numbers: California’s Fine Won’t Erase Yours”
3. SalesIntel is a Virginia-based B2B “sales intelligence” data broker, not a consumer people-search site — Captain Compliance; Gizmodo
4. Database of 200+ million professional contacts and 54 million U.S. mobile phone numbers; “career-change inferences” built from professional email domains, job-board activity, and LinkedIn signals; sells website-visitor identification/de-anonymization technology — Captain Compliance; Gizmodo
5. Required remedial actions: register with the Data Broker Registry, access and participate in DROP, process future deletion requests through it, publish consumer-privacy-rights metrics publicly — privacy.ca.gov; Captain Compliance
6. Michael Macko, CalPrivacy’s head of enforcement, directed a warning specifically at AdTech/identity-resolution companies to check whether they meet the legal definition of a data broker — Captain Compliance
7. This is CalPrivacy’s third data broker enforcement action in roughly a month, following LocateSmarter ($116,490 total) and Cybba ($52,400) — ScrubTrace’s own coverage of the LocateSmarter and Cybba settlements; total across the three cases put at roughly $205,000 by Captain Compliance
8. CalPrivacy’s Data Broker Enforcement Strike Force was established November 19, 2025, specifically to investigate Delete Act registration violations and CCPA violations by data brokers, building on a 2024 investigative sweep — cppa.ca.gov, official CPPA announcement
9. DROP requires a data broker to be registered before a consumer deletion request reaches it; a registration-failure fine addresses the registration gap going forward, not data already collected, and doesn’t help someone who doesn’t know the broker exists — independent reasoning grounded in DROP’s own published scope; consistent with the framing in Gizmodo’s own coverage of the same point
10. ScrubTrace’s own stated limitation (can’t promise removal from every broker, doesn’t claim knowledge of any specific broker’s holdings without confirmation) — ScrubTrace’s own existing stated position, not an external citation.