California lawmakers pass bill to make it easier to delete online personal data
Erasing your digital footprint could get a lot easier by 2026.
California lawmakers on Thursday passed a bill known as the Delete Act that would allow consumers, with a single request, to have every data broker delete their personal information. Data brokers include a variety of businesses that gather and sell people’s personal information, such as their address, marital status and spending habits. Those companies include credit reporting agencies, people-search sites and data analytic firms that work with political campaigns.
The Senate approved the legislation Thursday, a day after it was passed by the Assembly. The bill heads to the governor's desk for consideration.
Under Senate Bill 362, the California Privacy Protection Agency by January 2026 would create a way for consumers to ask that their records be erased through a single request. Roughly 500 data brokers are registered in California, so reaching out to every single broker can be time-consuming.
Currently, it's not always clear what information consumer data companies have or share. Businesses also might deny deletion requests or not respond.
The passage of SB 362 builds upon a sweeping data privacy bill lawmakers passed in 2018 with the California Consumer Privacy Act, which gave consumers the right to ask businesses to delete their personal data but through an unwieldy process.
Sen. Josh Becker (D-Menlo Park) said on the Senate floor that the bill would allow consumers to get sensitive information held by data brokers, including about reproductive health care and geolocation, erased.
"This bill will help Californians actually exercise the right to delete their information from data brokers and protect our right to privacy," Becker said.
The California attorney general's office sent a letter to Becker on Tuesday expressing support for the bill. In the letter, the office said the right to delete information from businesses is limited to data collected from the consumer. Data brokers might not always collect data directly from the consumer, creating a loophole in California's privacy law.
Businesses, including advertisers, lobbied aggressively against the legislation, saying it would “destroy California’s data-driven economy.” Businesses use data to serve personalized ads, and credit bureaus use personal information to verify people’s identities.
Dan Smith, president and chief executive of the Consumer Data Industry Assn., said in a statement that the bill could have "unintended consequences." The association represents credit bureaus and background-check companies.
“The bill undermines consumer fraud protections, hurts small businesses’ ability to compete, and solidifies the big platforms’ data dominance," Smith said. "It also empowers third parties to request to delete consumers’ data with no guardrails."
The bill’s supporters say consumers would have more control over their personal data online, which data brokers often collect without their consent or knowledge. They also point to scenarios in which people’s personal data could end up in the hands of scammers and other bad actors.
Amid resistance from businesses, Becker made changes to the bill. Consumers could exclude certain data brokers from their deletion request and there are exemptions. Starting in August 2026, data brokers would be required to delete all personal information of the consumer at least once every 45 days. An earlier version of the bill gave data brokers 31 days to do this. They would also be barred from selling or sharing new personal data.
If a data broker denies a deletion request because it can’t verify it, the request would be processed “as an opt-out of the sale or sharing of the consumer’s personal information.”
Get the best of the Los Angeles Times’ politics coverage with the Essential Politics newsletter.
This story originally appeared in Los Angeles Times.
