California legislature advances closely watched bill on data brokers

The California State Assembly’s Appropriations Committee voted to advance a bill that would make it far easier for individuals to block data brokers from collecting and selling their information without their consent.

The so-called California Delete Act, approved September 1, now heads to the full Assembly for a floor vote, which must occur by September 14. The bill already passed in the state Senate. While its overall fate is unclear, data privacy experts called the legislation’s progress noteworthy, particularly given an aggressive lobbying campaign against it from data brokers and advertisers.

Sen. Josh Becker (D-San Mateo) introduced the bill and said in a press release that it will create a “one-stop-shop” website where Californians can hit a single button to bar data brokers from collecting, maintaining and selling their information.

The legislation would be the first American law to allow consumers to demand universal deletion of their data. As it stands, citizens nationwide, including in California, must approach hundreds of individual data brokers to ask them to stop using their data for commercial purposes.

In California alone, there are currently more than 500 data brokers, experts said.

“The California Delete Act is an important, consumer-protective piece of privacy legislation to empower people to opt out of the sale of their data by some third-party data brokers, all through a single website,” data privacy expert Justin Sherman said via email.

Sherman, who leads a data brokerage project at Duke University’s Sanford School of Public Policy, said that 80% of Californians support the bill, but it has been subject to a fierce lobbying campaign by data brokers trying to “crush the regulation.”

Data brokers have built plans to use their own data and targeting capabilities to push anti-regulatory messages to California residents, said Sherman, who also recently founded the firm Global Cyber Strategies, which works on digital privacy threats.

In a LinkedIn post three weeks ago, Chad Engelgau, president of the data brokerage firm Acxiom, lambasted the California legislation.

He wrote that the law could “easily destroy” California’s data-driven economy and “negatively impact everyone in the marketing ecosystem, consumers included.”

“If you live in California, I encourage you to read up on the impacts of the bill and to look beyond its shiny packaging,” Engelgau wrote. “If you are in the Advertising, AdTech or the Marketing industry; you should be activating your resources to Say No to SB 362 [Delete Act] as it hurts all of us.”

If the bill passes on the Assembly floor, data brokers would have to register with the California Privacy Protection Agency (CPPA) and disclose what personal information they collect on consumers. The CPPA will be charged with creating a “simple way for Californians to direct all data brokers to delete their personal information, free of charge,” according to the Becker press release.

In 2022 the U.S. Senate considered a similar bill, but it never advanced out of committee. An updated federal Delete Act designed to allow people to force data brokers and companies to stop collecting personal data was reintroduced in Congress in June by a bipartisan group of legislators from both chambers.

The California bill is important, said Matt Schwartz, a policy analyst for privacy and technology policy at Consumer Reports who is closely monitoring its progress.

“Data brokers don't have a direct business relationship with the consumer so in many cases the consumer doesn't even know that the data broker exists, let alone that they have an entire dossier about them, Schwartz said.