California’s SB-361, an expansion of California’s Delete Act, soon will require registered data brokers to regularly check California’s data deletion database, or DROP, to determine if a California consumer has requested deletion of personal information.
Given the hefty fines for violations, companies that collect, buy, and sell Californians’ PI need to carefully assess whether they fall under the definition of a data broker and, if so, build compliance procedures to comply.
Data Broker Defined
While not every entity that collects and sells PI should be concerned about the new requirements, the definition of “data broker” is broad and may apply to entities outside of California. The California Privacy Protection Agency, or CPPA, already has targeted out-of-state-data brokers that collect and sell California consumers’ information, even when those companies tried screening out Californians’ PI.
Under the act, a data broker generally is a “business that knowingly collects and sells to third-parties the personal information of a consumer with whom the business does not have a direct relationship.”
PI is defined broadly as information that identifies, relates to, describes, or could be linked to a particular consumer or household, including names, addresses, IP addresses, email addresses, SSNs, and so on. A business has a “direct relationship” with the consumer if the consumer intentionally interacts with the business to access or learn about its products or services within the preceding three years.
The term “direct relationship” distinguishes businesses that collect and sell PI when a customer intentionally interacts with them (such as visiting a first party’s online clothing store) versus a business that doesn’t directly interact with the consumer but which collects or purchases consumers’ PI and resells it to other parties.
For instance, if a first party is operating its own clothing website and a third party hosts cookies or other systems that collect PI on that website, the consumer doesn’t intend to interact with the third-party collecting PI — it intends to interact with the first party selling clothing.
A business is still a data broker if it has a direct relationship with a consumer but also sells personal information about the consumer that the business didn’t collect directly from the consumer. Businesses that provide third-party website tracking technologies and businesses that sell data gathered by those third parties, among others, may be data brokers.
To determine if your business qualifies as a data broker, ask these questions:
Does your business knowingly collect and sell PI, such as names, IP addresses, and physical or email addresses from California consumers?Do consumers intentionally interact with your business to obtain information about your products or services (such as visiting your website)?Is your business an entity covered by enumerated exceptions under the act?How to Comply
Data brokers must comply with two major requirements under the Act. First, between Jan. 1 and Jan. 31 of each applicable year, the data broker must register with the CPPA and provide more than 20 categories of information. This includes what types of PI the data broker collects and whether the data broker shared or sold the PI to certain groups, including generative artificial intelligence developers.
Second, as of Aug. 1, 2026, data brokers will be required to access DROP at least every 45 days to determine if a consumer has made a deletion request. If so, the data broker must delete the information within 45 days of the request and direct its service providers or contractors to delete the information as well.
Continued compliance is necessary; once PI is deleted, the data broker can’t sell or share new PI from that consumer again unless the consumer indicates otherwise.
Failure to comply with either requirement risks $200 daily penalties for:
Each day the business failed to register.Each deletion request and each day the data broker fails to delete the requested information.Practical Guidance
It’s critical to consult experienced legal counsel to help establish a strong and successful defense to threatened claims and lawsuits. Any entity that collects and sells Californians’ PI should make several considerations.
Determine if you’re a data broker. If you’re collecting PI from Californians who don’t “intend” to interact with you, you may be a data broker and subject to the Act.
Double check your collection and customer database. Even if you don’t intend to interact with California consumers, collection of Californians’ PI may bring you into the CPPA’s crosshairs. If you’re selling PI to federal or state governments or generative AI companies, you’ll need to disclose this when registering under the Act.
Update compliance procedures. Data brokers should update their compliance procedures to ensure that they are checking DROP at least every 45 days and documenting and complying with any deletion requests. These compliance procedures should also include reviewing a checklist of vendors who will need to be informed to delete the PI as well.
Keep records on data deletion. Updated compliance procedures should include measures to cease collecting PI of consumers who have requested deletion of PI.
While there aren’t currently private rights of action for violations of SB-361, the CPPA soon will begin actively investigating and bringing enforcement actions against parties that may have violated the act. Actively checking and updating compliance procedures based on new requirements is the best way to stay ahead and defend against potential actions.
This article does not necessarily reflect the opinion of Bloomberg Industry Group Inc., the publisher of Bloomberg Law, Bloomberg Tax, and Bloomberg Government, or its owners.
Author Information
Sarah Miller is a litigation partner in Glaser Weil’s Newport Beach and Century City offices.
Elizabeth Sperling is a litigation partner and Joseph Montoya is a litigation associate in Glaser Weil’s San Diego office.
Interested in writing? Review our author guidelines, and submit pitches to Insights@bloombergindustry.com.