United States: The Data Market in California faces another blow as data brokers will be subject to additional obligations under the streamlined deletion mechanism for California consumers

In brief

If you are a data broker or a business that relies on data brokers for targeted advertising, you should be aware that the California Data Broker Law will be significantly changed under the California Delete Act.

On October 10, 2023, California Governor, Gavin Newsom, signed Senate Bill 362, referred to as the Delete Act, into law. The Delete Act amends existing data broker laws to subject all data brokers to new registration and disclosure requirements with the California Privacy Protection Agency (CPPA), in addition to creating one-stop deletion request mechanisms for consumers. As part of the new bill, data brokers will also be required to adhere to increased transparency requirements regarding precise geolocation data, reproductive health care data and personal data about minors.


Key Provisions

  • By January 1, 2026, the CPPA will establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains that consumer’s personal information delete it whether held by the data broker or associated service provider or contractor.
  • Beginning August 1, 2026, data brokers will have 45 days to process all deletion requests and delete all personal information related to the consumer making the request.
  • Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s personal information, data brokers will be required to delete all personal information of the consumer at least once every 45 days, and data brokers will be prohibited from selling or sharing new personal information of the consumer.
  • On or before January 31 following each year in which a business meets the definition of a data broker, data brokers will be required to register with, pay a registration fee to, and provide information to, the CPPA instead of the California Attorney General.
  • On or before July 1 of each year, data brokers will be required to compile and disclose specified information relating to the number of deletion and other requests received and the median and the mean number of days within which the data broker responded to such requests. 
  • Beginning January 1, 2028, and every three years thereafter, data brokers will be required to undergo an audit by an independent third party to determine compliance with these provisions and submit an audit report to the CPPA upon the agency’s written request.
  • The bill will also require data brokers to create a page on their website that details how a consumer may exercise their privacy rights.
  • Data brokers that fail to register with the CPPA will be subject to a daily fine of USD 100 to USD 200 for each day the company fails to register. Additionally, data brokers that fail to carry out deletion requests may be subject to a daily penalty of USD 200 per ignored request.


While some of the more substantive regulations are not effective until 2026, businesses should use this time to evaluate whether or not they meet the definition of a data broker. Business that partner with data brokers for marketing or other initiatives might also feel a ripple effect with less effective targeted advertising and reduced data services.

Business should update their data mapping and data classification exercises, updating websites, developing methods to keep track of consumer requests, and working with IT to develop mechanisms to adhere to the new deletion requirements

Copyright © 2024 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.