California has become the first US state to make it easier for residents to request that all of their data is scrubbed.
The Delete Act (SB 362) has been signed into law by California governor Gavin Newsom, as part of an effort to protect citizens’ online rights.
California residents need only make a single request to get all their data scrubbed from data brokers’ records. Previously, residents could still request that their data was deleted, but they were forced to submit a request to individual companies to achieve it.
In order to make the new requirements possible, the legislation also mandates that all data brokers register with the California Privacy Protection Agency (CPPA), which would create a single form for residents to request that their data is deleted.
Data brokers are companies that gather and sell people’s personal information, such as address, age or marital status. They include credit-reporting agencies, people-search sites and data analytics firms that work with political campaigns.
“Data brokers possess thousands of data points on each and every one of us, and they currently sell reproductive healthcare, geolocation and purchasing data to the highest bidder,” said senator Josh Becker. “The Delete Act protects our most sensitive information.”
However, advertising companies argue that the bill would undermine their industry, with businesses stressing that the law would “destroy California’s data-driven economy”.
Dan Smith, president and chief executive of the Consumer Data Industry Association, said that the bill could have “unintended consequences”.
“The bill undermines consumer fraud protections, hurts small businesses’ ability to compete and solidifies the big platforms’ data dominance,” Smith said. “It also empowers third parties to request to delete consumers’ data with no guardrails.”
Hayley Tsukayama, associate director of legislative activism at digital rights group the Electronic Frontier Foundation, said the Delete Act “will improve everyone’s privacy rights and make California’s consumer privacy laws more user-friendly, while also strengthening current California law that requires data brokers to register with the state”.
Rob Shavell, CEO of Delete Me, added that data brokers may have been taken by surprise by the amount of support for the bill because “they lobbied hard against this in creative ways with a lot of scare tactics”.
If data brokers don’t comply with these rules, the bill stipulates they be fined or otherwise penalised. According to Digiday, the fines for not registering with the CPPA could amount to $200 each, as well as an additional $200 fine per day that each request is not complied with.
The state will have until 2026 to implement the Delete Act.
