Senate Bill 362 for an act relating to data brokers was re-referred, on July 10, 2023, to the California Assembly Committee on Appropriations, having been passed with amendments by the Assembly Privacy and Consumer Protection and Judiciary Committees. The bill was first introduced to the California Senate on February 8, 2023, where it was approved with amendments, on May 31, 2023, before proceeding to the Assembly. In particular, the bill would require the California Privacy Protection Agency (CPPA) to establish, by January 1, 2026, an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor. To this end, the bill would require a data broker to register with, pay a registration fee to, and provide information to the CPPA, instead of the California Attorney General.

In addition, the bill would specify requirements for the accessible deletion mechanism in question, and would, starting from August 1, 2026, require a data broker to access the mechanism at least once every 31 days and, among other things, process all deletion requests, except as specified. Under the bill, from July 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer's data, a data broker would need to delete all personal information of the consumer at least once every 31 days and would prohibit the data broker from selling or sharing new personal information of the consumer, unless the consumer requests otherwise.

In this context, California Senator Josh Becker, who introduced the bill, stated, in a press release issued on April 11, 2023, that "[d]ata brokers spend their days and nights mining for personal information so they can build dossiers on millions of people and sell them to the highest bidder," adding that the bill "is based on a very simple premise: every Californian should be able to control who has access to their personal information and what they can do with it."

Separately, on July 19, 2023, the CPPA announced that its board unanimously voted to support the bill.

You can read the bill here, the press release here, and track the bill's progress here.

Update: September 5, 2023

DELETE Act passes Assembly Committee

On September 1, 2023, Becker announced that, on the same day, the Assembly Appropriations Committee voted to advance the bill to the Assembly Floor.

You can read the press release here, the bill here, and track its progress here.

Update: September 7, 2023

DELETE Act proceeds to third reading in Assembly

On September 5, 2023, the bill was read for a second time by the Assembly and ordered to its third reading.

You can read the bill here and track its progress here.

Update: September 14, 2023

DELETE Act sent to Senate for concurrence with Assembly amendments

On September 13, 2023, the bill was sent back to the Senate for concurrence with the amendments made in the Assembly.

You can read the bill here and track its progress here.

Update: September 15, 2023

DELETE Act passes both houses 

On September 14, 2023, the Senate concurred with the amendments introduced by the Assembly to the bill, which was thereafter ordered to engrossing and enrolling. 

You can read the bill here and track its progress here.

Update: October 11, 2023

DELETE Act signed into law

The Governor of California, Gavin Newsom, announced, on October 10, 2023, that they had signed the bill into law.

You can read the announcement here, the DELETE Act here, and view its history here.

Update: October 12, 2023

CPPA welcomes DELETE Act

On October 11, 2023, the California Privacy Protection Agency (CPPA) issued a statement welcoming the DELETE Act. The CPPA noted that the DELETE Act, which will go into force on January 1, 2024, transfers the administration, enforcement, and rulemaking authority over California's data broker registry from the California Department of Justice to the CPPA. 

Notably, the CPPA highlighted that California is the first state to pass a law to create an accessible deletion mechanism for consumers to delete their personal information held by data brokers in a single step.

You can read the statement here.