Governor Gavin Newsom’s signing of the Delete Act enhances current regulations, allowing users to remove information from individual pages
In a triumph for privacy advocates and consumers, California Governor Gavin Newsom has signed into law a bill that empowers residents to demand the removal of their personal information from the databases of all data brokers operating in the state.
This legislation, SB 362, commonly referred to as the Delete Act, was introduced by State Senator Josh Becker in April 2023 with the aim of granting Californians greater control over their privacy. While Californians already possess the right to request the deletion of their data under existing state privacy laws, this process involves submitting requests to each individual company.
The new bill reinforces the requirement for all data brokers to register with the California Privacy Protection Agency (CPPA). It mandates the CPPA to establish a user-friendly and cost-free method for Californians to request the deletion of their data from all state data brokers through a single platform, regardless of how that information was acquired. In case data brokers fail to adhere to these regulations, the bill specifies penalties and fines as potential consequences.
The signing of the Delete Act by Governor Newsom establishes California as a trailblazer in safeguarding consumer privacy, and we are resolute in our commitment to giving consumers back control over their personal data,” stated Becker. “Data brokers amass extensive data points on each individual, including sensitive information such as reproductive healthcare, geolocation, and purchase history, which they currently trade to the highest bidder. The Delete Act shields our most delicate information.”
While advocates of the bill have praised it as a more streamlined and user-friendly means of reinforcing existing California privacy laws, many advertising companies have contended that it would undermine their industry. These companies engage in the buying and selling of consumer data, including location, address, online behavior, and more, to a variety of clients, including law enforcement.
“In the absence of this data, smaller businesses will lose a vital avenue for reaching and attracting new customers, and consumers, in general, will have reduced exposure to new products and services that may pique their interest,” expressed a consortium of advertising trade associations in a letter initially reported by Adweek.
Rob Shavell, the CEO of Delete Me, a company dedicated to assisting individuals in removing their personal data from numerous data brokers, suggested that data brokers might not have anticipated the substantial backing the bill received. This is likely because, as Shavell noted, they had vigorously lobbied against it using inventive methods and a plethora of scare tactics.
For a significant period, advocates of civil liberties and privacy have been pushing for more robust regulations within the data broker industry. They’ve raised concerns about the lack of transparency concerning the sale and sharing of consumer data, as well as the ability for law enforcement to bypass subpoenas or warrants by purchasing otherwise inaccessible personal information from private companies. The Delete Act, according to Hayley Tsukayama, Associate Director of Legislative Activism at the Electronic Frontier Foundation, “will enhance everyone’s privacy rights and render California’s consumer privacy laws more accessible while reinforcing the existing requirement for data brokers to register with the state.”
In the past, as initially reported by The Guardian, agencies like the US Immigration and Customs Enforcement have employed data brokers to circumvent local laws, such as sanctuary policies that prohibit state or city agencies from assisting in immigration investigations. Additionally, there have been instances where a widely used global Muslim prayer app was found to have sold location data to a data broker that subsequently collaborated with military defense contractors. This revelation led to widespread calls to delete and discontinue using the app.
While the bill is generally regarded as a success, Shavell points out that its effectiveness is somewhat compromised due to the exemptions granted to certain companies by the bill’s author. These exemptions exclude companies that Delete Me would typically categorize as data brokers because they possess significant amounts of information about citizens.
The state has until 2026 to put the Delete Act into effect, but there are lingering concerns about the methods and agencies that will be responsible for enforcing the newly established regulations.
