In a victory for privacy advocates and consumers, the California governor Gavin Newsom signed a bill that would enable residents to request that their personal information be deleted from the coffers of all the data brokers in the state.
The bill, SB 362, otherwise known as the Delete Act, was introduced in April 2023 by the state senator Josh Becker in an attempt to give Californians more control over their privacy. Californians already have a right to request their data be deleted under current state privacy laws, but it requires filing a request with each individual company.
The new bill reinforces that all data brokers must register with the California privacy protection agency (CPPA), and it requires the CPPA to establish an easy and free way for Californians to request that all data brokers in the state delete their data through a single page, regardless of how they acquired that information. If data brokers don’t comply with these rules, the bill stipulates they be fined or otherwise penalized.
“Governor Newsom’s signature of the Delete Act enshrines California as a leader in consumer privacy, and we are determined to restore consumers’ control over their own personal data,” said Becker. “Data brokers possess thousands of data points on each and every one of us, and they currently sell reproductive healthcare, geolocation and purchasing data to the highest bidder. The Delete Act protects our most sensitive information.”
While proponents of the bill have lauded it as a less tedious and more user-friendly way to reinforce existing California privacy laws, many advertising companies have argued it would undermine their industry. Those companies buy and sell consumer information such as location, address, online activity and more to various clients including law enforcement.
“Absent this data, smaller enterprises will lose a critical path to reach and attract new customers, and consumers overall will have less exposure to new products and services that may interest them,” a group of ad trade bodies wrote in a letter first reported by Adweek.
Rob Shavell, the CEO of Delete Me, a company that helps people get their personal information off various data brokers, said data brokers may have been taken by surprise by the groundswell of support for the bill because “they lobbied hard against this in creative ways with a lot of scare tactics”.
Civil liberties and privacy advocates have long called for stronger regulations around the data broker industry, citing concerns about the lack of transparency into when and how consumer data is sold and shared and the ability for law enforcement to skip subpoenas or warrants by simply buying otherwise inaccessible personal information from a private company. The Delete Act “will improve everyone’s privacy rights and make California’s consumer privacy laws more user-friendly, while also strengthening current California law that requires data brokers to register with the state”, said Hayley Tsukayama, the associate director of legislative activism at digital rights group the Electronic Frontier Foundation.
In the past, as the Guardian first reported, agencies like the US Immigration and Customs Enforcement Agency have used data brokers to get around local laws such as sanctuary policies that prohibit state or city agencies from aiding with immigration investigations. One of the most popular global Muslim prayer apps was also revealed to have sold location information to a data broker, which in turn worked with military defense contractors, prompting mass calls to delete and stop using the app.
after newsletter promotion
However, though the bill is seen in large part as a success, Shavell says its limitations lie in the exemptions the author of the bill made for some companies Delete Me would otherwise consider data brokers because they “certainly have a lot of information about citizens”.
The state will have until 2026 to implement the Delete Act, but many still have questions about what mechanisms agencies will use to enforce the new rules as passed.