More Scrutiny Of California Data Brokers

As with many other areas of privacy law, it is not surprising that California continues to lead the nation in regulating data brokers – from promulgating new regulations to issuing a cluster of recent settlements. Therefore, it is crucial for companies to confirm whether they are subject to the Delete Act and pay careful attention to the registration and other regulatory requirements.

In addition, with the Delete Act's requirements related to the DROP (Delete Request and Opt-out Platform) mechanism coming into effect on Jan. 1, 2026, companies need to begin preparing now to intake requests.

What is the Delete Act?

Since 2019, California has required data brokers to register with the attorney general. In 2023, the Delete Act was passed, modifying the data broker registration law and imposing additional requirements. Specifically, the Delete Act requires data brokers to (1) provide additional information regarding their collection of three highly sensitive data