{"id":405060,"date":"2026-07-20T08:48:13","date_gmt":"2026-07-20T08:48:13","guid":{"rendered":"https:\/\/www.newsbeep.com\/us-ca\/405060\/"},"modified":"2026-07-20T08:48:13","modified_gmt":"2026-07-20T08:48:13","slug":"california-data-brokers-must-build-a-new-compliance-playbook","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us-ca\/405060\/","title":{"rendered":"California Data Brokers Must Build a New Compliance Playbook"},"content":{"rendered":"

California\u2019s SB-361<\/a>, an expansion of California\u2019s Delete Act, soon will require registered data brokers to regularly check California\u2019s data deletion database, or DROP, to determine if a California consumer has requested deletion of personal information. <\/p>\n

Given the hefty fines for violations, companies that collect, buy, and sell Californians\u2019 PI need to carefully assess whether they fall under the definition of a data broker and, if so, build compliance procedures to comply.<\/p>\n

Data Broker Defined<\/p>\n

While not every entity that collects and sells PI should be concerned about the new requirements, the definition of \u201cdata broker\u201d is broad and may apply to entities outside of California. The California Privacy Protection Agency, or CPPA, already has targeted<\/a> out-of-state-data brokers that collect and sell California consumers\u2019 information, even when those companies tried screening out Californians\u2019 PI.<\/p>\n

Under the act, a data broker<\/a> generally is a \u201cbusiness that knowingly collects and sells to third-parties the personal information of a consumer with whom the business does not have a direct relationship.\u201d <\/p>\n

PI is defined broadly as information that identifies, relates to, describes, or could be linked to a particular consumer or household, including names, addresses, IP addresses, email addresses, SSNs, and so on. A business has a \u201cdirect relationship\u201d with the consumer if the consumer intentionally interacts with the business to access or learn about its products or services within the preceding three years.<\/p>\n

The term \u201cdirect relationship\u201d distinguishes businesses that collect and sell PI when a customer intentionally interacts with them (such as visiting a first party\u2019s online clothing store) versus a business that doesn\u2019t directly interact with the consumer but which collects or purchases consumers\u2019 PI and resells it to other parties. <\/p>\n

For instance, if a first party is operating its own clothing website and a third party hosts cookies or other systems that collect PI on that website, the consumer doesn\u2019t intend to interact with the third-party collecting PI \u2014 it intends to interact with the first party selling clothing.<\/p>\n

A business is still a data broker if it has a direct relationship with a consumer but also sells personal information about the consumer that the business didn\u2019t collect directly from the consumer. Businesses that provide third-party website tracking technologies and businesses that sell data gathered by those third parties, among others, may be data brokers.<\/p>\n

To determine if your business qualifies as a data broker, ask these questions:<\/p>\n

Does your business knowingly collect and sell PI, such as names, IP addresses, and physical or email addresses from California consumers?Do consumers intentionally interact with your business to obtain information about your products or services (such as visiting your website)?Is your business an entity covered by enumerated exceptions under the act?How to Comply<\/p>\n

Data brokers must comply with two major requirements under the Act. First, between Jan. 1 and Jan. 31 of each applicable year,<\/a> the data broker must register with the CPPA and provide more than 20 categories of information. This includes what types of PI the data broker collects and whether the data broker shared or sold the PI to certain groups, including generative artificial intelligence developers.<\/p>\n

Second, as of Aug. 1, 2026, data brokers will be required to access DROP at least every 45 days to determine if a consumer has made a deletion request. If so, the data broker must delete the information within 45 days of the request and direct its service providers or contractors to delete the information as well. <\/p>\n

Continued compliance is necessary; once PI is deleted, the data broker can\u2019t sell or share new PI from that consumer again unless the consumer indicates otherwise. <\/p>\n

Failure to comply with either requirement risks $200 daily penalties for:<\/p>\n

Each day the business failed to register.Each deletion request and each day the data broker fails to delete the requested information.Practical Guidance<\/p>\n

It\u2019s critical to consult experienced legal counsel to help establish a strong and successful defense to threatened claims and lawsuits. Any entity that collects and sells Californians\u2019 PI should make several considerations.<\/p>\n

Determine if you\u2019re a data broker. If you\u2019re collecting PI from Californians who don\u2019t \u201cintend\u201d to interact with you, you may be a data broker and subject to the Act.<\/p>\n

Double check your collection and customer database. Even if you don\u2019t intend to interact with California consumers, collection of Californians\u2019 PI may bring you into the CPPA\u2019s crosshairs. If you\u2019re selling PI to federal or state governments or generative AI companies, you\u2019ll need to disclose this when registering under the Act.<\/p>\n

Update compliance procedures. Data brokers should update their compliance procedures to ensure that they are checking DROP at least every 45 days and documenting and complying with any deletion requests. These compliance procedures should also include reviewing a checklist of vendors who will need to be informed to delete the PI as well.<\/p>\n

Keep records on data deletion. Updated compliance procedures should include measures to cease collecting PI of consumers who have requested deletion of PI.<\/p>\n

While there aren\u2019t currently private rights of action for violations of SB-361, the CPPA soon will begin actively investigating and bringing enforcement actions against parties that may have violated the act. Actively checking and updating compliance procedures based on new requirements is the best way to stay ahead and defend against potential actions.<\/p>\n

This article does not necessarily reflect the opinion of Bloomberg Industry Group Inc., the publisher of Bloomberg Law, Bloomberg Tax, and Bloomberg Government, or its owners.<\/p>\n

Author Information<\/p>\n

Sarah Miller<\/a> is a litigation partner in Glaser Weil\u2019s Newport Beach and Century City offices.<\/p>\n

Elizabeth Sperling<\/a> is a litigation partner and Joseph Montoya<\/a> is a litigation associate in Glaser Weil\u2019s San Diego office.<\/p>\n

Interested in writing? Review our \u2060author guidelines,<\/a> and submit pitches to Insights@bloombergindustry.com.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"California\u2019s SB-361, an expansion of California\u2019s Delete Act, soon will require registered data brokers to regularly check California\u2019s…\n","protected":false},"author":2,"featured_media":405061,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[7,9,8,97791,60829,16514,132411],"class_list":["post-405060","post","type-post","status-publish","format-standard","has-post-thumbnail","category-california","tag-california","tag-california-headlines","tag-california-news","tag-consumer-privacy","tag-generative-artificial-intelligence","tag-internet-tracking","tag-online-sales"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/405060","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/comments?post=405060"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/405060\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media\/405061"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media?parent=405060"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/categories?post=405060"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/tags?post=405060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}