California Continues To Expand Data Broker Requirements

Companies are become increasingly concerned about being viewed as "selling" personal data. In the midst of these worries, California's governor signed SB 361, which will change the California Delete Act starting January 1, 2026. The law applies to those who sell personal information about consumers with whom they do not have a direct relationship. For covered entities, the amendment will add to compliance complexities.

The bill adds more disclosure obligations when a data broker registers with the state. Currently, data brokers must disclose when registering if they collected five different kinds of information. These include children's information or reproductive health information. That list has now been almost tripled. New elements to disclose as part of registering include if the broker collects biometric data and mobile advertising IDs. As amended, data brokers will also need to state if they sell information to foreign actors or US governmental bodies or