https://calmatters.digitaldemocracy.org/bills/ca_202520260sb361
Existing law requires a data broker to register with the [California Privacy Protection Agency, ] pay a registration fee in an amount determined by the agency and provide specified information, including, among other things, the name of the data broker and its primary physical, email, and internet website addresses, and whether the data broker collects the personal information of minors, consumers precise geolocation, or consumers reproductive health care data.
This bill would require a data broker to provide additional information to the agency [and] require a data broker to provide information regarding whether, in the past year, the data broker shared or sold consumers data to a foreign actor, as defined, the federal government, other state governments, law enforcement, as provided, or a developer of a GenAI system, as defined. The bill would make changes to the administrative fines and costs that apply to data brokers who fail to register.
Existing law requires, beginning January 1, 2026, the [CCPA] to establish an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker [,as well as provide] access the accessible deletion mechanism at least once every 45 days and, among other things, process a denied request to delete personal information as an opt-out of the sale or sharing of the consumers personal information under the CCPA, as specified.
This bill would require a data broker to process the above-described denied request within 45 days of receiving the request.