Californians are more aware than most when it comes to the privacy problems linked to tech giants headquartered in their backyard like Apple, Google, Meta and TikTok. However, lurking in the shadows is the overlooked data broker industry, which has become a multibillion-dollar business, primarily fueled by the collection and sale of your personal data.
When the California Legislature cannonballed into the privacy conversation in 2018 by passing the California Consumer Privacy Act, or CCPA, it created a wave that continues to crest to this day. California’s bold leap, coupled with continued inaction by Congress, has encouraged more and more states to take up the cause on their own, with baseline privacy rights extended to more than 100 million Americans through comprehensive state laws.
However, even with CCPA and other state privacy laws, there are still blind spots that leave consumers underprotected. Thankfully, California took another huge step toward addressing this problem by passing the Delete Act. California is now the first state in the nation to allow consumers to request universal deletion of their information from data brokers.
This new law, Senate Bill 362, is crucial to reign in the shady data broker industry that until now has largely avoided scrutiny. Data brokers make money by collecting and selling extremely granular personal details about individuals, often without our knowledge or consent.
These companies know incredible amounts of information about us, including our online behavior (did you put that Nutella in your shopping cart?), our preferences (are you a weekend camper or a beach bum?), our income and addresses (past and present), and — thanks to ubiquitous tracking on mobile devices — even our precise movements throughout the day.
This information is then sold and resold, often to entities like social media companies or advertisers, but also potentially to ex-spouses, law enforcement or others who might have an interest in tracking you.
Data brokers collect such information by purchasing it from companies (or purchasing the companies themselves), scraping it from online or public information sources, or even inferring it through machine learning techniques. That’s right. Even if a data broker is missing some piece of information about you, they might just guess it, sometimes to wildly inaccurate ends.
Since consumers often have no direct contact with data brokers, they might not realize these entities exist, let alone that they have detailed dossiers about them that include countless data points.
The Delete Act will help consumers claw some semblance of control back from this largely unregulated industry. Most importantly, its protections are actually usable.
Today, theoretically, you could ask each individual data broker to stop selling your information. But how are you supposed to know which ones actually have it? Even if you identified all the relevant brokers, Consumer Reports found that it is incredibly burdensome and confusing to exercise your rights in this manner.
In lieu of this wild goose chase, the Delete Act makes things easy for consumers. Similar to how authorized agents and universal opt-out signals work under CCPA, the law requires the California Privacy Protection Agency to create a universal deletion mechanism that will allow consumers to send out a deletion request to all of the state’s registered data brokers with a single click of a button. If you do not want to be tracked in the manner described above, all you’ll have to do is set your preference once and brokers will be required to honor it until you tell them to stop.
That’s a choice everybody deserves. When the universal deletion mechanism becomes active in 2026, data brokers should prepare to seek higher ground because the California privacy wave is coming — this time for them.
Matt Schwartz is a policy analyst at Consumer Reports. He wrote this commentary for CalMatters.
