In a victory for privacy advocates and consumers, California Governor Gavin Newsom signed a bill that would let residents request that their personal information be deleted from the coffers of all data brokers in the state.
The Californian state senator, Josh Becker, introduced the bill in April 2023, offering Californians more control over their privacy. Californians can request their data be deleted under current state privacy laws, but it requires filing a request with each individual company.
The bill states that all data brokers in California must register with the California Privacy Protection Agency, and it requires the CPPA to establish an easy and free way for Californians to request that all data brokers delete their data through a single page, regardless of how they acquired that information. If data brokers fail to follow these rules, the bill states they will be fined or otherwise penalized.
While proponents of the bill have lauded it as a less complicated and more user-friendly way to enhance existing California privacy laws, many advertising firms have argued it would undermine their industry. Those firms sell consumer information such as location, address, online activity and more to various clients, including law enforcement.
Rob Shavell, chief executive of Delete Me, said that data brokers have been taken by surprise by the groundswell of support for the bill because they lobbied hard against this in creative ways with a lot of scare tactics.
Civil Liberties and Privacy advocates have long advocated for stricter regulations surrounding the data broker industry, with concerns about the lack of transparency regarding when and how consumer data is sold and shared, and the ability for law enforcement to skip subpoenas or warrants by simply purchasing other inaccessible personal information from a private company. The Delete Act will improve everyone's privacy rights and make California's consumer privacy laws more user-friendly, while also strengthening current California law that requires data brokers to register with the state, said Hayley Tsukayama, the associate director of legislative activism at the Electronic Frontier Foundation.
The Guardian reported that agencies like the US Immigration and customs Enforcement Agency have used data brokers to get around local laws like sanctuary policies that prohibit state and city agencies from aiding with immigration investigations. One of the most popular global Muslim prayer apps has been revealed to have sold location information to a data broker, who then worked with military defense contractors, leading to mass calls to discontinue and discontinue the app.
While the bill is seen in large part as a success, Shavell said its limitations lay in the exemptions that the author of the bill made for some companies Delete Me would otherwise consider data brokers because they 'certainly have a lot of information about citizens'.
The state will have until 2026 to implement the Delete Act, but many have questions about what mechanisms agencies will use to enforce the new rules as they are passed.