California's privacy agency fined an Iowa data broker $116,490 this week, partly for making people hand over the last four digits of their Social Security number before they could opt out of having their data sold. Two days later a Boston broker got $52,400 for never registering at all. The agency called that SSN demand a data minimisation breach, which is the right call. If your opt-out form asks for more than your signup form did, you've built a deterrent and labelled it verification.

privacy.ca.gov/2026/08/…