California Expands Data Broker Transparency | Delete Act

California’s privacy updates, SB 361 and the Delete Act, promote transparency and consumer empowerment, setting a national example for data privacy reform. These new laws and consumer protection attorneys can help consumers take charge of their data and hold companies accountable for responsible data practices.

Call our firm to discuss taking legal action when data brokers and other entities misuse your data.

Overview of New California Privacy Laws

California is continuing to strengthen its privacy and consumer protection laws with Senate Bill 361 adding new requirements for data brokers operating in the state.

This law expands California’s existing data broker registration process that requires companies to share more details about how they use personal data. These changes come shortly after the California Privacy Protection Agency (CPPA) approved new regulations under the 2023 Delete Act, creating a statewide system allowing residents to request deletion of their personal information. That system is set to launch in August 2026.

Together, SB 361 and the Delete Act create one of the strongest data transparency frameworks in the country.

Businesses that buy or sell consumer data will face tighter reporting obligations, and consumers will more control over their personal information.

What Is the Delete Act?

The Delete Act, passed in 2023, is a privacy law that gives Californians a simple way to remove their personal data from hundreds of data broker databases at once.

Under the Act, the CPPA will build a central online deletion portal where residents can file a single request to have their information deleted by every registered data broker. Once submitted, all brokers must erase the consumer’s data and stop collecting it unless another law allows retention.

The Delete Act also requires brokers to disclose the categories of data they collect and explain how they process deletion requests. Enforcement begins in August 2026, giving businesses time to adjust their systems.

When combined with SB 361, the Delete Act improves transparency and strengthens consumer privacy rights statewide.

What’s Changing for Data Brokers

Previously, California required data brokers to disclose only limited information when registering annually with the CPPA. SB 361 broadens the requirements. Now, companies must report if they collect any of the following:

• Names, dates of birth, ZIP Codes, email addresses, or phone numbers
• Account login credentials, such as usernames and passwords
• Government-issued IDs, including driver’s licenses, Social Security numbers, or passports
• Digital identifiers like mobile ad IDs or vehicle identification numbers
• Citizenship or immigration data
• Union membership information
• Sexual orientation or gender expression data
• Biometric data such as fingerprints or facial recognition

New Rules About Sharing and Selling Data

SB 361 also introduces new requirements about who data brokers share information with. Companies must now disclose whether they have sold or shared personal data within the past year to:

1. A foreign government or organization
2. The U.S. federal government
3. Another state government
4. Law enforcement (unless under subpoena or court order)
5. A developer of a generative AI (GenAI) system or model

A “GenAI developer” is any person or company that designs or modifies artificial intelligence systems that generate content. The law does not yet define what counts as a “substantial modification,” leaving room for future clarification.

Why Hire The Lyon Firm

Joe Lyon represents individuals and organizations in data privacy and consumer protection matters nationwide. Our firm’s attorneys can help clients review whether companies are following CPPA reporting standards and pursue legal action when data rights are ignored.

The Lyon Firm offers free consultations and remains committed to protecting privacy rights for clients nationwide.