In a significant move to enhance data privacy and consumer protection, California recently passed Senate Bill 362, commonly referred to as the “Delete Act.” This legislation introduces important changes to how data brokers operate within the state. The Delete Act brings data brokers under the purview of the California Privacy Protection Agency (CPPA) and mandates various requirements and deadlines for compliance.
In this blog post, we’ll break down the key components of the Delete Act and what it means for both data brokers and consumers.
Background: CCPA and CPRA
Before diving into the specifics of the Delete Act, it’s essential to understand the context. The California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA) set the stage for enhanced data privacy in California. These laws granted consumers several rights, including the right to request information about the data collected, the right to request data deletion, and the right to opt-out of data sales.
The Delete Act’s Core Provisions
- Registration with CPPA: Under the Delete Act, data brokers are required to register with the California Privacy Protection Agency (CPPA). This agency is responsible for enforcing the law and ensuring compliance.
- One-Stop-Shop Mechanism: The CPPA is tasked with developing a user-friendly mechanism by January 1, 2026. This mechanism allows securely verified consumers to request the deletion and tracking of their personal data from data brokers. Starting August 1, 2026, data brokers must process deletion requests within 45 days of receiving a verified request.
- Incorporating CCPA Definitions:The Delete Act incorporates definitions from the CCPA into its provisions, aligning terminology and regulations.
- Compliance Reporting: Data brokers must compile and disclose specific information related to requests received under the CCPA. They are also required to provide this information to the agency annually.
- Accessible Deletion Mechanism: By January 1, 2026, the agency must establish an accessible deletion mechanism that allows consumers to request the deletion of their data from all data brokers through a single verifiable request.
- Regular Audits: Data brokers must undergo an audit by an independent third party every three years, beginning January 1, 2028. Audit reports must be submitted to the agency upon request.
- Fees: The agency may charge data brokers a fee for accessing the accessible deletion mechanism.
Penalties and Funds
The Delete Act imposes penalties, fees, expenses, and costs on data brokers for non-compliance with its provisions. These financial consequences are collected and managed in the Data Brokers’ Registry Fund, administered by the agency. The fund’s usage has been expanded to cover state court expenses, enforcement costs, and the maintenance of the accessible deletion mechanism.
The California “Delete Act” represents a significant step forward in data privacy regulation. By requiring data brokers to register with the CPPA, implement accessible deletion mechanisms, and undergo regular audits, the state aims to protect consumers’ personal information more effectively. Data brokers operating in California should be aware of these changes and take the necessary steps to ensure compliance. As of now, the Delete Act strengthens California’s commitment to data privacy and consumer rights, reinforcing its position as a leader in data protection legislation.
