Groundbreaking Data Broker Bill Passes California Legislature

California lawmakers on Thursday sent to Gov. Gavin Newsom’s desk a first-in-the-nation measure that would impose new regulations on data brokers—companies that amass and sell personal information—by giving residents significantly more control over the collection of their personal data.

The bill (S.B. 362) by state Sen. Josh Becker (D) would grant a state resident the ability to delete all personal data collected by the state’s nearly 500 registered data brokers through a single “delete button” housed at the website for the California Privacy Protection Agency. It passed the state Assembly on a 52-14 vote on Wednesday. The state Senate cleared it on a 31-9 vote Thursday.

Privacy advocates have promoted the bill as a groundbreaking measure that would put California at the forefront of regulating the data broker industry. It’s a simple solution, they said, to the burdensome task for an individual to go to each broker and request that their data be deleted.

“This is indeed a mighty swing at regulating data brokers,” said Emory Roane, policy counsel at Privacy Rights Clearinghouse, a nonprofit public interest group that helped create the bill. “In our view, this would set the high-water mark globally.”

The bill received last-minute backing from state Attorney General Rob Bonta on Tuesday, and abortion groups also threw their support behind the measure.

But tech and advertising groups portray the bill as a fatal blow to the data sharing economy, vastly limiting the amount of data available and hurting the services that depend on such information, such as identity verification. They argued that it would concentrate data in the hands of a few Big Tech companies—leaving smaller businesses behind and creating a new windfall for the data-deletion industry.

“The result would be a massive ripple of unintended consequences on people’s everyday lives and California’s entire economy,” said Dan Smith, CEO of the Consumer Data Industry Association.

Becker addressed some concerns from the industry in revising his bill, such as allowing brokers to deny a deletion request for data security, a reasonable business purpose, and other exceptions outlined under current state privacy law.

The Becker measure also would establish rules that if a deletion request cannot be verified, the broker should instead process the request as opting out of the sale or sharing of data.

Some industry groups, however, indicated that the issue around the data broker legislation is not fully over.

“Given the glaring and dramatic failures in the bill, the only good news is that there are more than two years until it goes into effect, so the legislature has time to return to this issue early in the next session to act on the critical fixes needed,” said Chris Oswald, with the Association of National Advertisers, in a statement Wednesday.

To contact the reporter on this story: Titus Wu in Sacramento, Calif. at twu@bloombergindustry.com

To contact the editors responsible for this story: Bill Swindell at bswindell@bloombergindustry.com; Stephanie Gleason at sgleason@bloombergindustry.com