California enacts first-of-its-kind bill targeting data brokers

California lawmakers enacted unprecedented legislation late Wednesday allowing state residents to compel data brokers to delete their personal information with the push of a button.

Privacy advocates have closely watched the legislation — called the DELETE Act — and consider the first-of-its-kind bill to be significant. They say it could give momentum to the passage of similar laws in other states.

The new rules passed despite fierce lobbying from the data broker and advertising industries.

Under the law, California residents will be able to visit a single website to request that the 500-plus registered data brokers in the state remove their personal information from vast databases and continue to delete those residents’ data every 45 days moving forward.

The California Privacy Protection Agency will be charged with establishing the website where residents can quickly and easily force companies to delete their data instead of having to contact every website they have ever visited in addition to the state’s registered data brokers, according to Matt Schwartz, a policy analyst at Consumer Reports.

The fact that industry fought so hard to stop the bill underscores its importance, he said. “This bill is highly significant and does provide a really meaningful consumer right that a lot of data brokers don't want to provide because they know that it's going to strike at the heart of their business,” Schwartz told Recorded Future News.

He said it is telling that data brokers “fought so hard” to block consumers from having the right to easily delete their personal data from brokers’ databases. “That's a pretty basic choice that consumers ought to have — whether they want to have a ‘business relationship’ with someone,” he said. The fact that brokers don’t want citizens to have that right “tells you about their values on transparency in consumer choice.”

The data broker industry is expected to expand by 6.8% between 2022 and 2031, according to Transparency Market Research, which estimates the market will be worth $462.4 billion by 2031.

The president of one of the country’s largest data brokerage firms urged the advertising and marketing industries to push hard against the bill in a LinkedIn post last month.

Chad Engelgau, president of the data brokerage firm Acxiom, said the legislation could “easily destroy” California’s data-driven economy and “negatively impact” consumers and all entities in the marketing industry.

“If you live in California, I encourage you to read up on the impacts of the bill and to look beyond its shiny packaging,” Engelgau wrote. “If you are in the Advertising, AdTech or the Marketing industry; you should be activating your resources to Say No to SB 362 [Delete Act] as it hurts all of us.”

Last week a leader of the National Federation of Independent Business (NFIB) wrote an editorial for the California Business Journal arguing that the law will “stack the deck against California’s small businesses … Instead of the Delete Act, it would be the Delete Small Business Act.”

“Not only does the legislation open the door for more manipulation of consumers’ data for identity theft, but it also effectively cements big businesses’ dominant positions in the marketplace by making it nearly impossible for small businesses to attract new customers,” wrote Sunder Ramani, leadership council chair for the NFIB.

The fight over California’s legislation may just be the first of many battles, as other states weigh their own data laws.

Hayley Tsukayama, associate director of legislative activism at the Electronic Frontier Foundation said advocates “hope other states looking to address data broker issues consider [the Delete Act] as a template.”

A bipartisan group of federal legislators introduced their own DELETE Act in June. As with the California legislation, it would allow individuals to systematically request all data brokers delete personal data collected in the past and stop tracking them in the future.

The federal legislation would direct the Federal Trade Commission (FTC) to set up an “online dashboard for Americans to submit a one-time data deletion request that would be sent to all data brokers registered,” a press release from one of the co-sponsors said.

Similar legislation has died in prior Congressional sessions.

Correction: A previous version of this story incorrectly stated that industry lobbyists accused a California legislator of supporting the bill for his own financial benefit.