California allows users to request data brokers to delete their data

In this day and age, where every website and app uses cookies to track our movements and habits, data brokers have gained unprecedented access to our personal data. However, this vast amount of data poses a serious privacy concern, as malicious entities can exploit it for identity theft. Now, in an effort to address this issue, California Governor Gavin Newsom has recently enacted new legislation known as the Delete Act, allowing users to request data brokers to either delete their data or prevent its sale and sharing—all through a single, comprehensive request.

Senator Josh Becker pointed out the critical flaw in the existing system, referring to it as a “loophole big enough to drive a few million stolen identities through.” Furthermore, he emphasized that data brokers have been selling consumers’ data, including details on reproductive healthcare, geolocation, and purchasing behaviour, to the highest bidder without ever obtaining the user’s consent.

Making a new system

To make this system possible, the California Privacy Protection Agency (CPPA) will create a user-friendly mechanism for Californians to submit data deletion requests by January 1, 2026. Additionally, data brokers will need to regularly check and honour new data privacy requests every 45 days, and the government will conduct audits every three years, starting in 2028, to ensure compliance.

Furthermore, with over 500 data brokers in California, the Delete Act mandates these entities to disclose information regarding the types of data they possess and even obligates them to delete the data obtained from third-party sources. Finally, brokers failing to comply with the act may face civil penalties and administrative fines.

“The law is the most decisive step we’ve seen lawmakers take to rein in the shadowy business of data brokers. It rejects the idea that companies should be able to commercially exploit the most sensitive details of lives with impunity,” said John Davisson, Director of Litigation and Senior Counsel at the Electronic Privacy Information Center (EPIC).

Concerns surrounding the new legislation

While California’s new Delete Act represents a significant step forward in data privacy, Justin Hakes, VP of Communications for the Consumer Data Industry Association, voiced his concerns, stating that it could undermine fraud protections and hinder small businesses’ ability to compete with data giants.