115 data brokers told California they collect consumers' precise geolocation

115 of the 603 data brokers in California's 2026 registry answered Yes when asked whether they collect consumers' precise geolocation. That is 19.1% of the file. Under California law, precise geolocation means device data used to locate a person within a circle with a radius of 1,850 feet. We counted the answers on October 12, 2026 in CalPrivacy's registry file, last updated July 29, 2026. All 115 are listed below, with what each said about sharing or selling data to governments, law enforcement, foreign actors and AI developers.

Figures above were counted from CalPrivacy's registry files (registry.csv, last updated July 29, 2026, and registry2025.csv) on 2026-10-12. The definition is from Civil Code section 1798.140(w). See sources.

The question, and what precise geolocation means

Every data broker that registers in California must answer a list of Yes or No questions. Civil Code section 1798.99.82(b)(2)(M) requires: "Whether the data broker collects consumers’ precise geolocation." The registry file records the answer in column T.

The Delete Act does not define the term itself. Section 1798.99.80(a) says: "The definitions in Section 1798.140 shall apply unless otherwise specified in this title." Section 1798.140 is the California Consumer Privacy Act (CCPA). Its subdivision (w) says precise geolocation "means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations."

A circle with a 1,850-foot radius covers about 0.39 square miles. The CCPA also lists a consumer's precise geolocation as sensitive personal information, in section 1798.140(ae)(1)(C), and section 1798.185(a)(12) allows regulations that further define the term. We searched the CCPA regulations CalPrivacy posts as effective January 1, 2026, and found no different radius in them.

According to the registry page, the businesses in the 2026 file "operated as data brokers in 2025." The answers are the brokers' own; CalPrivacy publishes what each broker submitted.

The 115 brokers, A to Z

Who the 115 said they shared or sold data to

22 of the 115 answered Yes to at least one of the five recipient questions; 93 answered No to all five. Nine answered Yes to one, four to two and nine to three. None answered Yes to four or five.

The eight brokers that answered Yes to both precise geolocation and law enforcement are: Babel Street, Inc.; DTN, LLC; Enformion, LLC; Fog Data science LLC; LexisNexis Risk Solutions FL Inc.; Pen-Link, Ltd.; PropertyRadar, Inc.; and SpyCloud Inc. The law enforcement question excludes data shared "unless that data was shared pursuant to a subpoena or court order", in the words of section 1798.99.82(b)(2)(R), so a No does not rule out data provided under a subpoena or court order.

The five that answered Yes to both precise geolocation and a foreign actor are: CoStar Realty Information, Inc.; Healthcare Inc; Onfocus SAS; Semcasting, Inc.; and Ziff Davis LLC. Under section 1798.99.82(f)(1), a foreign actor is the government of, or an organization based in, a foreign adversary country; CalPrivacy's Enforcement Advisory 2026-01 names these as China, Iran, North Korea and Russia. The one that answered Yes to both precise geolocation and a GenAI developer is iSpot.tv, Inc. The AI question is covered in our page on the 32 brokers that shared data with GenAI developers.

Where the 115 are based

105 list a U.S. address, 4 Canada, 2 the United Kingdom, and 1 each Germany, France, India and Singapore. Among U.S. addresses, after combining state abbreviations and full names (for example CA and California), the most common states are New York (21), California (19), Florida (13) and Virginia (8). The 105 U.S. entries name 29 states plus the District of Columbia.

How the count compares with earlier registry files

CalPrivacy also posts the 2025 and 2024 registry files. Both include a question on whether the broker collects consumers' precise geolocation, so the counts can be set side by side.

We also matched names between the 2026 and 2025 files, using only identical names (ignoring spacing and capital letters). 70 of the 115 appear under the same name in the 2025 file: 48 answered Yes there and 22 answered No. In the other direction, 14 brokers that answered Yes in the 2025 file answered No in 2026 under the same name. A company that changed how it spelled its name would not be matched this way.

CalPrivacy actions that mention location data

We read the list of Board enforcement decisions on CalPrivacy's site and the decisions about brokers among the 115. One of those decisions mentions location data. So do one enforcement advisory and one settlement announcement on CalPrivacy's site.

• Cybba, Inc. (Board decision ordered August 10, 2026). The decision's factual findings say: "The personal information sold includes geolocation data, internet activity data, inferences, identifiers, and commercial data." The case itself is about registration timing: "Cybba failed to register as a data broker with the Agency by the January 31, 2025 deadline for its data broker activity in year 2024." The decision orders a fine of $52,400 and says Cybba registered on time in 2026 for its 2025 activity. The 2026 file lists Cybba Inc. among the 115.
• Enforcement Advisory 2026-01 (September 3, 2026). The advisory, on the accuracy of registration answers, lists precise geolocation among the types of information brokers must disclose. One hypothetical describes a business whose software development kit, used in mobile apps, "gathered information about consumers’ locations and mapped the information to stores or other organizations within 500 feet." The advisory says incorrect registration information can bring a $200 fine for each day it appears in the registry.
• General Motors settlement (announced May 8, 2026). CalPrivacy's site carries the Attorney General's announcement of a settlement with General Motors, reached with four county district attorneys and with support from CalPrivacy. The announcement says that, as alleged in the complaint, from 2020 to 2024 GM sold "names, contact information, geolocation data, and driving behavior data" of Californians to two data brokers. It says the settlement "includes $12.75 million in civil penalties" and is "subject to court approval". The 2026 registry lists General Motors LLC among the 115; we note only that the name appears in both records.

Deletion requests to these brokers

California residents can send one deletion request to registered data brokers through DROP, CalPrivacy's Delete Request and Opt-out Platform. The registry page says: "Data brokers are required to begin processing these requests on August 1, 2026." How the platform works is on our DROP page.

What a Yes does not tell you

• Whether the broker sells location data. The question asks whether a broker collects precise geolocation. No column says whether location data itself was sold, to whom, or how much.
• The source or precision. The file does not say whether the data comes from apps, cars, phones or other devices, or how close to the 1,850-foot limit it is.
• Which recipient got which data. The five recipient questions cover consumers' data in general, not location data in particular.
• Whether the answer is right. Answers are self-reported, and CalPrivacy's enforcement advisory says incorrect answers can be fined. How answers can change after the file is posted is covered in our page on the 2026 registry.

What we could not confirm

• Federal Trade Commission orders on location data. The FTC's website (ftc.gov) did not return its pages to our automated reader on 2026-10-12, so we do not describe any FTC action here.
• Whether a court has approved the General Motors settlement. The announcement we read, dated May 8, 2026, says it is subject to court approval; we found no later CalPrivacy page on its status.
• The outcome of AB 322, a bill on precise geolocation. At CalPrivacy's August 7, 2026 Board meeting, staff said the bill was in Appropriations. We did not read the Legislature's site and found no CalPrivacy page on its final status.
• How the 115 compares with the 2026 file as first posted in March 2026. We counted only the July 29, 2026 version.
• The on-screen wording of the registration form, which is not public. The wording quoted here comes from the statute.

Sources

• 2026 registry file, registry.csv (last updated July 29, 2026) - CalPrivacy, downloaded and counted 2026-10-12
• 2025 registry file - CalPrivacy, downloaded and counted 2026-10-12
• 2024 registry file - CalPrivacy, downloaded and counted 2026-10-12
• California Data Broker Registry page - CalPrivacy (cppa.ca.gov), read 2026-10-12
• Delete Act, Civil Code sections 1798.99.80-1798.99.89, effective January 1, 2026 - CalPrivacy PDF, read 2026-10-12
• California Consumer Privacy Act, effective January 1, 2026 (section 1798.140) - CalPrivacy PDF, read 2026-10-12
• CCPA Regulations, effective January 1, 2026 - CalPrivacy PDF, read 2026-10-12
• Board enforcement decisions - CalPrivacy (privacy.ca.gov), read 2026-10-12
• In the Matter of Cybba, Inc., Order of Decision and Stipulated Final Order - CalPrivacy PDF, read 2026-10-12
• CalPrivacy Announces Second Data Broker Enforcement Action in Less than a Week, August 13, 2026 - CalPrivacy newsroom, read 2026-10-12
• Enforcement Advisory No. 2026-01, Accuracy of Data Broker Registration Information, September 3, 2026 - CalPrivacy PDF, read 2026-10-12
• General Motors privacy settlement announcement, May 8, 2026 - CalPrivacy newsroom, read 2026-10-12
• Transcript of the CalPrivacy Board meeting, August 7, 2026 - CalPrivacy PDF, read 2026-10-12

Source links are not affiliate links. This page is general information, not legal advice; how these rules apply depends on the facts and the state.