CPPA Releases Data Broker Regulations For Public Comment

On July 5, 2024, the California Privacy Protection Agency (CPPA) released a notice of proposed rulemaking and proposed regulations to implement the DELETE Act, which requires "data brokers" to register with the CPPA and to disclose certain information to the CPPA and in their website privacy policies (for more details on the DELETE Act, see our previous advisory).

The CPPA stated that it initiated this rulemaking primarily to address "common questions and occasional obstacles that indicated a need for clarification of [the DELETE Act's] registration requirements." The proposed regulations in large part address administrative issues (e.g., clarifying how fees may be paid and whether they can be prorated or refunded). However, the proposed rules also clarify key definitions, including the meaning of "direct relationship" (i.e., between businesses and consumers to make clear which businesses will be deemed "data brokers"), "minor," and "reproductive health care data."