California’s new law makes it easier for consumers to request the deletion of their data
Prior laws required Californians to contact each individual company.
California is officially the first state to pass a law streamlining personal data removal. On October 10, Governor Gavin Newsom signed SB 362, known as the Delete Act, into law, requiring the California Privacy Protection Agency (CPPA) to create and roll out a tool allowing state residents to request that all data brokers delete their information. There are nearly 500 registered data brokers in California.
Advocates for the bill painted it as a necessary protection. “Data brokers possess thousands of data points on each and every one of us, and they currently sell reproductive healthcare, geolocation, and purchasing data to the highest bidder,” Senator Josh Becker, author of the bill, said in a statement. “The Delete Act protects our most sensitive information.”
Current privacy laws allow Californians to make this request, but they must contact each company, and it can be denied. The CPPA has until 2026 to build the necessary system and has the authority to charge brokers to use it. Under the Delete Act, each broker must register with the CPPA and fulfill deletion requests every 45 days or risk facing a penalty such as a fine. Third-party compliance audits are set to begin in 2028 and occur every three years moving forward.
The Delete Act met opposition from organizations such as the Association of National Advertisers, which voiced concerns about schemes that charge consumers exorbitant amounts of money to delete their data and small businesses or non-profits being unable to reach their target audience without this detailed information.
