California has emerged as a trailblazer in data privacy legislation with the recent enactment of Senate Bill 362, marking the most comprehensive law targeting data brokers in the United States. Data broker companies compiling and selling personal information from various outlets face new regulations that have sparked debates between privacy advocates and advertising companies.
California’s Innovative Approach
1. Background and Motivation
In response to the 2017 Equifax data breach, California became the second state, following Vermont, to mandate the registration of data brokers with the state in 2019. This aimed to bring transparency to data collection practices, particularly when brokers acquire information indirectly from third parties. To enhance oversight, the new law doubles fines for non-registration and shifts control of the registry from the state attorney general’s office to the California Privacy Protection Agency.
Want to know if you’re earning what you deserve? Find out with LawCrossing’s salary surveys.
2. Deletion Mechanism Implementation
The key feature of the law is the creation of a “delete button” by 2026, allowing consumers to request the removal of their data from all registered brokers with a single action. The agency is tasked with working out the details, including a secure process for consumer data submission and verification by brokers. Brokers must access the mechanism every 45 days, ensuring prompt processing of deletion requests. Reports and audits will be mandatory, highlighting denied requests and processing times.
3. Downstream Effects and Industry Response
While the law received praise from privacy advocates, the advertising and data-sharing industry expressed concerns about potential business model disruptions. Many business groups argue that the law could limit data availability for smaller companies and critical services like identity verification. The definition of “data broker” is expected to increase registrations, possibly resulting in industry consolidation as smaller entities may struggle with compliance costs. Consumer participation remains uncertain, with efforts expected to educate individuals on the potential consequences of deleting all personal data.
Future Outlook
Despite the law’s enactment, the industry may push for legislative changes before the full implementation in 2026. Some anticipate legal challenges, and observers closely monitor potential amendments and lawsuits.
In conclusion, California’s ambitious data privacy law reflects a significant step forward in addressing the challenges posed by data brokers while sparking a broader conversation about the balance between individual privacy and business interests.
Don’t be a silent ninja! Let us know your thoughts in the comment section below.