Key Provisions

• By January 1, 2026, the CPPA will establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains that consumer’s personal information delete it whether held by the data broker or associated service provider or contractor.
• Beginning August 1, 2026, data brokers will have 45 days to process all deletion requests and delete all personal information related to the consumer making the request.
• Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s personal information, data brokers will be required to delete all personal information of the consumer at least once every 45 days, and data brokers will be prohibited from selling or sharing new personal information of the consumer.
• On or before January 31 following each year in which a business meets the definition of a data broker, data brokers will be required to register with, pay a registration fee to, and provide information to, the CPPA instead of the California Attorney General.
• On or before July 1 of each year, data brokers will be required to compile and disclose specified information relating to the number of deletion and other requests received and the median and the mean number of days within which the data broker responded to such requests. 
• Beginning January 1, 2028, and every three years thereafter, data brokers will be required to undergo an audit by an independent third party to determine compliance with these provisions and submit an audit report to the CPPA upon the agency’s written request.
• The bill will also require data brokers to create a page on their website that details how a consumer may exercise their privacy rights.
• Data brokers that fail to register with the CPPA will be subject to a daily fine of USD 100 to USD 200 for each day the company fails to register. Additionally, data brokers that fail to carry out deletion requests may be subject to a daily penalty of USD 200 per ignored request.

Takeaways

While some of the more substantive regulations are not effective until 2026, businesses should use this time to evaluate whether or not they meet the definition of a data broker. Business that partner with data brokers for marketing or other initiatives might also feel a ripple effect with less effective targeted advertising and reduced data services.

Business should update their data mapping and data classification exercises, updating websites, developing methods to keep track of consumer requests, and working with IT to develop mechanisms to adhere to the new deletion requirements