SB 361: Data brokers: data collection and deletion.

Official summary

Legislative Counsel’s Digest (official, as of the latest version). Written by nonpartisan legislative staff; reproduced verbatim.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, including the right to request that a business disclose specified information that has been collected about the consumer, to request that a business delete personal information about the consumer that the business has collected from the consumer, and to direct a business not to sell or share the consumer’s personal information, as specified. The CCPA defines various terms for these purposes. The California Privacy Rights Act of 2020 (CPRA), approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

Existing law requires a data broker to register with the agency, and defines “data broker” to mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. Existing law requires a data broker, in registering with the agency, to pay a registration fee in an amount determined by the agency and provide specified information, including, among other things, the name of the data broker and its primary physical, email, and internet website addresses, and whether the data broker collects the personal information of minors, consumers’ precise geolocation, or consumers’ reproductive health care data.

This bill would require a data broker to provide additional information to the agency, including whether the data broker collects consumers’ names, dates of birth, ZIP Codes, email addresses, phone numbers, login or account information, various government identification numbers, mobile advertising, connected television, or vehicle identification numbers, citizenship data, union membership status, sexual orientation status, gender identity and gender expression data, biometric data, and up to 3, but no fewer than one, of the most common types of personal information that the data broker collects, as provided. The bill would also require a data broker to provide information regarding whether, in the past year, the data broker shared or sold consumers’ data to a foreign actor, as defined, the federal government, other state governments, law enforcement, as provided, or a developer of a GenAI system, as defined. The bill would make changes to the administrative fines and costs that apply to data brokers who fail to register.

Existing law requires, beginning January 1, 2026, the California Privacy Protection Agency to establish an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor. Existing law requires, beginning August 1, 2026, a data broker to access the accessible deletion mechanism at least once every 45 days and, among other things, process a denied request to delete personal information as an opt-out of the sale or sharing of the consumer’s personal information under the CCPA, as specified.

This bill would require a data broker to process the above-described denied request within 45 days of receiving the request.

Existing law requires the agency to create a page on its internet website where registration information provided by data brokers and the accessible deletion mechanism is accessible to the public.

Sponsors

Sponsors by party (alphabetical): Democratic 1

“Support” is shown only as formal sponsorship recorded by the legislature. Roll-call votes are available on the official bill page.

Recent official actions

1. October 8, 2025Chaptered by Secretary of State. Chapter 466, Statutes of 2025.
2. October 8, 2025Approved by the Governor.
3. September 22, 2025Enrolled and presented to the Governor at 11 a.m.
4. September 11, 2025Assembly amendments concurred in. (Ayes 40. Noes 0. Page 2892.) Ordered to engrossing and enrolling.
5. September 10, 2025In Senate. Concurrence in Assembly amendments pending.
6. September 10, 2025Read third time. Passed. (Ayes 79. Noes 0. Page 3168.) Ordered to the Senate.
7. August 26, 2025Ordered to third reading.
8. August 26, 2025Read third time and amended.
9. July 14, 2025Ordered to third reading.
10. July 14, 2025From consent calendar on motion of Assembly Member Aguiar-Curry.
11. July 10, 2025Read second time. Ordered to consent calendar.
12. July 9, 2025From committee: Do pass. Ordered to consent calendar. (Ayes 15. Noes 0.) (July 9).