Californians Get Stronger Deletion Rights Against Data Brokers

Gov. Gavin Newsom on Tuesday signed a first-in-the-nation measure that would impose new regulations on data brokers—companies that amass and sell personal information—by giving residents unprecedented control to delete their personal data that has been collected.

The bill (S.B. 362) by state Sen. Josh Becker (D) grants a state resident, beginning 2026, the ability to delete all personal data collected by the state’s nearly 500 registered data brokers through a single “delete button” housed at the website for the California Privacy Protection Agency.

Privacy advocates have promoted the bill as a groundbreaking measure that puts California at the forefront of regulating the data broker industry. Alongside Vermont, the Golden State is only one of two states to have a data broker registry. The new law is a simple solution, advocates said, to the burdensome task for an individual to go to each broker and request that their data be deleted.

The bill received backing from state Attorney General Rob Bonta and abortion groups.

Tech and advertising groups have portrayed the bill as a fatal blow to the data sharing economy, vastly limiting the amount of data available and harming the services that depend on such information, such as identity verification. They argued that the measure would result in concentrating personal data in the hands of a few Big Tech companies—leaving smaller businesses behind and creating a new windfall for the data-deletion industry.

“The result would be a massive ripple of unintended consequences on people’s everyday lives and California’s entire economy,” said Dan Smith, CEO of the Consumer Data Industry Association.

Some industry groups indicated that they intend to push lawmakers to revisit the issue in future sessions to ease burdens on them.

“Given the glaring and dramatic failures in the bill, the only good news is that there are more than two years until it goes into effect, so the legislature has time to return to this issue early in the next session to act on the critical fixes needed,” said Chris Oswald, with the Association of National Advertisers, in a September statement.

The focus will now turn to the privacy agency, which could develop regulations for compliance with the legislation. Privacy professionals will be looking toward the agency for clarity on who more will be considered data brokers and any technical details over accessing the mechanism to delete consumers’ data.