In a groundbreaking move that promises to reshape the landscape of data privacy and protection, California has raised the bar for data broker regulation with the newly enacted Delete Act. This pioneering legislation not only imposes stringent data deletion and disclosure obligations but also ushers in a new era of accountability for data brokers, setting the stage for other states to follow suit.

The Delete Act: Empowering Consumers with a Single Click

Sacramento, CA — Governor Gavin Newsom's recent signing of the Delete Act marks a significant leap in the realm of data privacy. This law mandates that businesses engaged in the collection and sale of personal information without direct consumer relationships must honor consumer requests for data deletion with just a single click.

While states like California, Vermont, Texas, and Oregon already require data brokers to register, the Delete Act goes a step further. It distinguishes itself as the nation's first measure allowing consumers to request mass deletion of their personal information by data brokers. These entities, known for their clandestine gathering and sale of comprehensive consumer profiles, are now facing intensified scrutiny.

Nancy Libin, partner and co-chair of the technology, communications, privacy, and security practice at Davis Wright Tremaine LLP, commented on California's bold stance: "It'll be interesting to see how it's applied and enforced moving forward."

California's History of Leading the Way

California has a rich history of pioneering data privacy and security initiatives. In 2002, it became the first state to introduce a data breach notification law. This pivotal move set a precedent that all other U.S. states subsequently followed. In 2018, California passed the groundbreaking California Consumer Privacy Act, inspiring over a dozen states to implement similar data protection laws. Furthermore, a novel law, established in California last year, compelled social media platforms to enhance privacy protections for children, serving as a model for other states.

David Stauss, co-leader of the privacy and data security practice group at Husch Blackwell LLP, asserted, "The Delete Act sets a high-water mark for data broker laws, and if history repeats itself, we will certainly see lawmakers in other states look to what California has done."

Reporting and Technical Obligations

The Delete Act imposes reporting and technical obligations on companies. The fledgling California Privacy Protection Agency is tasked with launching a one-stop-shop website by 2026, allowing consumers to request data deletion from all registered data brokers. Companies must check this database every 45 days, maintain websites detailing their data collection and sale practices, and describe how they handle deletion requests.

Matt Schwartz, a policy analyst at Consumer Reports, explained, "This bill is multifunctional in the way it both sheds light on the industry and gives consumers a data deletion right that's usable."

California Raises Data Broker Regulation : Penalties for Non-Compliance

The Delete Act reinforces these obligations with substantial penalties. The California Privacy Protection Agency is expected to vigorously pursue violations, including daily fines of at least $200 for failing to adhere to registration requirements and $200 per deletion request for each day without data scrubbing. This framework elevates the risk for numerous covered companies.

California Raises Data Broker Regulation : The Road Ahead

Though the full implementation of the Delete Act is still years away, companies must start preparing now. Uncertainties linger about the universal deletion mechanism's operation, data collection after deletion requests, and identity verification.

As the effective date for deletion requirements approaches, the California Privacy Protection Agency is anticipated to dedicate more resources to data broker oversight. Companies outside of California should also monitor developments, as other states and federal lawmakers may follow suit.

U.S. Senator Ron Wyden, D-Ore., applauded California's initiative and hoped that it would inspire other states and Congress to empower consumers nationwide. Federal recommendations from the Federal Trade Commission in 2014 called for increased transparency and consumer control over data brokers.

While Texas and Oregon have introduced data broker registries, they lack data transparency, access, and deletion requirements. The Delete Act's proactive approach may prompt other states to take similar steps.

James Davisson from EPIC emphasized the need for a comprehensive privacy framework that emphasizes data minimization, suggesting that the new California law be incorporated into a broader privacy law with a robust data minimization framework.

In a rapidly evolving digital age, California's Delete Act stands as a beacon of consumer empowerment and privacy protection, setting a new standard for data broker regulation.