SB 1104: California Consumer Privacy Act of 2018: data broker registration: accessible deletion mechanism.

Official summary

Legislative Counsel’s Digest (official, as of the latest version). Written by nonpartisan legislative staff; reproduced verbatim.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants to a consumer various rights with respect to personal information that is collected by a business.

Existing law, the California Privacy Rights Act of 2020 (CPRA), an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

Existing law requires a data broker to register with the agency, and defines “data broker” to mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions.

This bill would define a “direct relationship” as, among other things, when a consumer has intentionally interacted with a business for the purpose of obtaining information about, accessing, purchasing, using, or requesting the business’s products or services. The bill would specify circumstances when a data broker does not have a “direct relationship,” including if it sells personal information outside of a “first-party” interaction with the consumer. The bill would define a “first party” as a consumer-facing business with which the consumer intends and expects to interact.

Existing law requires a data broker, in registering with the agency, to provide specified information, including, among other things, whether the data broker collects the personal information of minors or a consumer’s reproductive health care data. Existing law requires the agency to establish an accessible deletion mechanism that, among other things, allows a consumer to request that a specified data broker delete any personal information related to that consumer held by the data broker or associated service provider or contractor.

This bill would require a data broker to provide additional information to the agency regarding whether the data broker sells inferences about the attributes of the consumer based on their analysis of specified data, including the personal information of minors and a consumer’s reproductive health care data.

Sponsors

Sponsors by party (alphabetical): Democratic 1

“Support” is shown only as formal sponsorship recorded by the legislature. Roll-call votes are available on the official bill page.

Recent official actions

1. May 14, 2026May 14 hearing: Held in committee and under submission.
2. May 12, 2026Set for hearing May 14.
3. May 11, 2026May 11 hearing: Placed on APPR. suspense file.
4. May 4, 2026Set for hearing May 11.
5. April 23, 2026Read second time and amended. Re-referred to Com. on APPR.
6. April 22, 2026From committee: Do pass as amended and re-refer to Com. on APPR. (Ayes 7. Noes 1. Page 3957.) (April 20).
7. April 9, 2026Set for hearing April 20.
8. April 9, 2026From committee with author's amendments. Read second time and amended. Re-referred to Com. on P., D.T., & C.P.
9. February 26, 2026Referred to Com. on P., D.T., & C.P.
10. February 17, 2026From printer. May be acted upon on or after March 16.
11. February 13, 2026Introduced. Read first time. To Com. on RLS. for assignment. To print.