California bill would crack down on data brokers

Data brokers are going to California with an aching in their hearts.

The state, the first to adopt a comprehensive consumer privacy law that is often considered a harbinger of privacy legislation to come, is considering a new bill that could further regulate the data broker industry.

The bill, called the Delete Act, is headed to a full vote later this month.

While California’s existing privacy laws allow citizens to ask brokers to delete their data, the Delete Act would streamline the process, creating what’s described in the bill as an “accessible deletion mechanism” that would essentially require all data brokers to “empty trash” on an individual, if they ask. In other words, it would give residents a one-stop shop for these requests, as opposed to asking each data broker individually.

The state already maintains a public registry of data brokers, which lists at least 500. Additionally, after a data broker processes a consumer’s deletion request, the bill would require it to delete “all personal information of the consumer” at least once every 45 days. If passed, it would go into effect in 2026.

Earlier this year, Planned Parenthood and the Electronic Frontier Foundation voiced support for the bill, with the latter describing the current process for requesting data deletion as something that “can become time-consuming and tedious.”

“We really need to be thinking about the risks to all of us of having this information floating out there and thinking of ways to get people control back over that information,” California State Senator Josh Becker, author of the Delete Act, told Digiday.

Unsurprisingly, some in the ad-tech industry don’t seem to be in love with the bill. The Consumer Data Industry Association, a trade association that doesn’t appear to publicly list its members, created a website that encourages Californians to oppose the bill. “SB 362 would cause tremendous damage across California’s data-driven economy by using a blunt-force approach on this complicated and vital system,” the website reads.

Meanwhile, in August, Politico reported that IPG was “pulling out all the stops” to prevent the bill from passing, according to internal emails between agency execs that were obtained by the outlet. IPG owns the data broker Acxiom.