On October 8, the governor of California signed into law SB 361 to amend the California Consumer Privacy Act and the California Privacy Rights Act by strengthening requirements for data brokers.
The act requires data brokers provide expanded registration information to the California Privacy Protection Agency, including whether they collect consumers’ names, dates of birth, ZIP Codes, email addresses, phone numbers, login or account information, government identification numbers, mobile advertising, connected television, or vehicle identification numbers, citizenship data, union membership status, sexual orientation status, gender identity and gender expression data, and biometric data.
Data brokers also must report whether, in the past year, they shared or sold consumers’ data to a foreign actor, federal or state governments, law enforcement, or a generative AI developer. The bill increased administrative fines for noncompliance, imposing a $200 daily penalty for failure to register and a $200 daily penalty for each deletion request not processed as required under existing California law.
[View source.]