Californians gain right to delete online data

Governor Gavin Newsom’s approval of the Delete Act strengthens existing regulations, enabling users to erase information from specific pages.

In a victory for privacy advocates and consumers, California Governor Gavin Newsom has endorsed a bill granting residents the authority to request the deletion of their personal information from the databases of all data brokers operating in the state.

This legislation, known as SB 362 or the Delete Act, was introduced by State Senator Josh Becker in April 2023 to provide Californians with increased control over their privacy. Although Californians already have the right to request data deletion under existing state privacy laws, the current procedure requires submitting requests to each individual company.

The newly enacted bill strengthens the obligation for all data brokers to register with the California Privacy Protection Agency (CPPA). It directs the CPPA to create a user-friendly and free-of-charge process for Californians to demand the deletion of their data from all state data brokers using a unified platform, irrespective of how the information was obtained. The bill outlines penalties and fines as potential consequences in case data brokers do not comply with these regulations.

Governor Newsom’s endorsement of the Delete Act solidifies California’s leadership in protecting consumer privacy, and we are steadfast in our dedication to restoring control over personal data to consumers,” asserted Becker. “Data brokers accumulate a wealth of data points on individuals, encompassing sensitive details like reproductive healthcare, geolocation, and purchasing history, currently traded to the highest bidder. The Delete Act safeguards our most delicate information.”

While supporters of the legislation have lauded it as a more efficient and user-friendly approach to reinforcing existing California privacy laws, numerous advertising companies have argued that it would undermine their industry. These firms participate in the buying and selling of consumer data, including location, address, online behavior, and more, serving a diverse range of clients, including law enforcement.

In the absence of this data, smaller businesses will lose a vital avenue for reaching and attracting new customers, and consumers, in general, will have reduced exposure to new products and services that may pique their interest,” expressed a consortium of advertising trade associations in a letter initially reported by Adweek.

Rob Shavell, the CEO of Delete Me, a company dedicated to assisting individuals in removing their personal data from numerous data brokers, suggested that data brokers might not have anticipated the substantial backing the bill received. This is likely because, as Shavell noted, they had vigorously lobbied against it using inventive methods and a plethora of scare tactics.

For a significant period, advocates of civil liberties and privacy have been pushing for more robust regulations within the data broker industry. They’ve raised concerns about the lack of transparency concerning the sale and sharing of consumer data, as well as the ability for law enforcement to bypass subpoenas or warrants by purchasing otherwise inaccessible personal information from private companies. The Delete Act, according to Hayley Tsukayama, Associate Director of Legislative Activism at the Electronic Frontier Foundation, “will enhance everyone’s privacy rights and render California’s consumer privacy laws more accessible while reinforcing the existing requirement for data brokers to register with the state.”

In the past, as initially reported by The Guardian, agencies like the US Immigration and Customs Enforcement have employed data brokers to circumvent local laws, such as sanctuary policies that prohibit state or city agencies from assisting in immigration investigations. Additionally, there have been instances where a widely used global Muslim prayer app was found to have sold location data to a data broker that subsequently collaborated with military defense contractors. This revelation led to widespread calls to delete and discontinue using the app.

While the bill is generally regarded as a success, Shavell points out that its effectiveness is somewhat compromised due to the exemptions granted to certain companies by the bill’s author. These exemptions exclude companies that Delete Me would typically categorize as data brokers because they possess significant amounts of information about citizens.

The state has until 2026 to implement the Delete Act, but there are lingering concerns about the methods and agencies that will be responsible for enforcing the newly established regulations.