With the Delete Act, California Enacts Another Groundbreaking Privacy Law

Background

California's newest consumer privacy law, the Delete Act, was signed into law on October 10, 2023. The Delete Act provides consumers with the right to request the deletion of their personal information held by various data brokers subject to the law through a single request. The law also modifies the existing registration requirements for data brokers and imposes a new audit requirement. 

The Delete Act defines a "data broker" as a "business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." The definition exempts entities covered under the federal Fair Credit Reporting Act and the Gramm-Leach-Bliley Act, the federal Health Information Portability and Accountability Act, California's Insurance Information and Privacy Protection Act, and the California Confidentiality of Medical Information Act. 

While California, Vermont, Oregon, and Texas have existing data broker registration laws, the Delete Act is more expansive. Key new requirements applicable to data brokers under the Delete Act are discussed below. 

The CPPA is the New California Data Broker Regulator

The Delete Act positions the CPPA as the new California data broker regulator. Prior to the Delete Act, data brokers were required to register with the California Attorney General and were subject to enforcement action by the Attorney General for violating the registration requirements. With the passage of the Delete Act, the registration and enforcement responsibilities have shifted to the CPPA.

Deletion of Consumer Personal Information

By January 1, 2026, the CPPA is required to create a free "accessible deletion mechanism" that allows consumers "through a single verifiable request" to delete their personal information from "every data broker." Consumers would be able to selectively exclude specific data brokers from their request, as well as modify a previously submitted request. Additionally, a consumer's authorized agent would be allowed to make a deletion request through such mechanism. 

Starting on August 1, 2026, once every 45 days the registered data brokers will be required to access the deletion mechanism to process new deletion requests and to delete any new personal information of consumers who have previously submitted deletion requests. The CPPA will assess a fee on data brokers to access the mechanism. 

Modified Registration Requirements

The Delete Act also modifies the existing California data brokers registration requirements. Currently, data brokers are required to register with the California Attorney General. Starting in January 2024, data brokers must register with the CPPA instead. Data brokers also must provide additional information than previously required, such as information and metrics related to processing consumer privacy requests under the California Consumer Privacy Act; whether they collect certain categories of information (minors' information, precise geolocation of consumers, and reproductive health information); and provide a website link where California consumers can exercise their privacy rights. 

If a data broker is exempt because of the applicability of federal or California laws noted above, it is still required to describe whether and to what extent it is regulated under the exempted laws.

Audit Requirements and Penalties

The Delete Act imposes a new audit requirement and stiff penalties for violations. Starting January 1, 2028, data brokers will be required to undergo an independent audit every three years to certify their compliance with the law. The CPPA may request such audits and data brokers must keep audit records for at least six years. Data brokers will also be subject to a $200 per day fine for failing to register and/or for each failure to delete a California consumer's personal information. The CPPA also is empowered to seek any expenses it incurred in investigating noncompliant data brokers.