On October 10, 2023, California Governor Gavin Newsom signed Senate Bill 362, also known as the “Delete Act.” The Delete Act, the subject of a previous FKKS blog post, will make it easy for Californians to request that data brokers – entities that knowingly collect and sell the data of consumers with whom they do not have a direct relationship – delete their personal information with a single request. A “Do Not Call” list for digital information.

The California Privacy Protection Agency has until January 2026 to build a centralized tool for consumers to submit deletion requests. Data brokers must then regularly process deletion requests on an ongoing basis, and delete all consumer data in their possession within 45 days. It also doubles the fines for violations from $100 to $200 per day that a data broker fails to register or act on a request.

Currently there are approximately 500 registered data brokers in California, which can be found on a searchable registry.

Californians already have the right to request that businesses delete their personal information under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. But to do so, they must submit individual requests to each business. The Delete Act is a major step forward towards streamlining Californians’ ability to exercise their rights regarding their personal data, albeit only with respect to the relatively small number of businesses that are categorized as data brokers.

Takeaway

Both California and Vermont have laws requiring data brokers register and pay an annual fee.

Businesses that knowingly collect, sell and/or license the personal data of consumers with whom the business does not have a direct relationship should consult with counsel and register as soon as possible. Registration is relatively quick and inexpensive, and may protect companies from steeper fines and increasing regulatory scrutiny, as momentum builds for privacy protections across the country.