The proposed California Delete Act, also known as Senate Bill 362, could have a far-reaching impact on data brokers and the privacy infringements they cause. If passed, this bill has the potential to become a template for similar legislation across the nation, as California often sets the tone for tech developments. By addressing the loopholes in current state laws, the California Delete Act aims to give residents more control over their personally identifiable information (PII) and provide a pathway for a federal data opt-out process.
Data brokers are companies that gather information about consumers from various sources and sell it to third parties. They collect data from public records, credit card transactions, social media, and other platforms to create profiles on individuals. These profiles can contain sensitive information, such as contact details, family information, sexual orientation, reproductive health, and even geolocation. While data brokers operate legally, they rarely vet their customers, allowing anyone, including marketers, law enforcement agencies, and cybercriminals, to access this personal information.
The California Delete Act aims to close the loophole that allows data brokers to collect information from third-party sources without requiring their consent. If passed, the bill would require data brokers to register with the California Privacy Protection Agency (CPPA) public registry and disclose the information they collect. They would also have to provide and adhere to a one-time universal opt-out process through the California Privacy Protection Agency dashboard. Additionally, data brokers would be required to disclose the requests they receive from consumers and create a “do not track” list similar to the federal “do not call” list to limit robocalls.
The significance of the California Delete Act lies not only in its potential impact on California residents but also in its ability to influence other states. Since California was the first state to pass comprehensive privacy legislation in 2019, other states have followed suit with their own versions of privacy laws. If the California Delete Act passes, it is highly likely that other states will enact similar legislation, especially considering the growing interest in regulating data brokers.
The pressure for nationwide equivalence may also come from the data broker industry itself. Managing different rules for different jurisdictions can be burdensome and costly for businesses operating in multiple states. Moreover, multiple overlapping sets of rules are not ideal at the federal level either. Congress has already shown an interest in regulating the data broker industry, and a simple regulation that emphasizes consumer transparency and easy opt-out processes would be a win for all parties involved.
The passage of the California Delete Act is highly likely, as it has already received strong support in the California Senate, passing by a vote of 32–8. It also enjoys the support of reproductive rights groups like Planned Parenthood, which adds political relevance and visibility to the bill. If the bill becomes law, it will send a clear message to the data broker industry that the days of indiscriminate data collection and sale are over.
However, enforcement of the California Delete Act may pose a challenge. While compliance can be enforced through the California Attorney General’s office, the reality is that the state may not have the resources to audit and enforce the bill’s provisions effectively. This is where private-public enforcement becomes crucial. Companies like Privacy Bee, which has reached out to hundreds of thousands of data brokers with opt-out requests in the past decade, will play a crucial role in ensuring compliance. With the legal requirement to comply with opt requests, data brokers will face consequences for noncompliance. However, individuals will still need to rely on the private sector to ensure that opt-outs actually happen and report any instances of noncompliance.
In conclusion, the California Delete Act has the potential to be a game-changer in the fight against data brokers and their intrusive practices. By closing loopholes and providing better protections for residents, this legislation could set the stage for similar laws across the nation. As technology continues to advance, it is vital to prioritize individual privacy and ensure that consumers have control over their own personal information. The California Delete Act could be a significant step in achieving that goal.