WTF is California’s proposed ‘Delete Act’?

The “Delete Act,” officially known as Senate Bill 362, was introduced in April by California State Senator Josh Becker (D-Menlo Park) and would give consumers a way to delete their personal information from every data broker in the state through a single verifiable consumer request. (The proposal comes less than a year after CPRA went into effect in January).

California isn’t the only state going after data brokers. Vermont, Texas and Oregon have also passed laws that create data-broker registries, with Vermont’s in effect since 2019, Texas’s taking effect in next month and Oregon’s starting in 2024. Federal regulatory agencies including the Consumer Financial Protection Bureau and the Federal Trade Commission have also opened inquires into the industry. And in Congress, the Energy & Commerce Committee opened a bi-partisan investigation in April by sending letters to dozens of data brokers asking for information about how they collect and use consumer data.

For Digiday’s ongoing WTF Series about the complexities of the ad-tech world here’s an explainer about the “Delete Act,” what the bill entails, the privacy groups in favor of the proposal and why the ad industry wants to quash it.

What is the Delete Act?

California’s current privacy laws give California residents expanded control over their personal information, but they currently have to ask every single data broker to delete their data — a tricky task when many of the companies that collect and share data aren’t household names.

If the “Delete Act” passes, it would update CPRA and create a way for consumers to have all their data deleted en masse. (The current law only requires data brokers to delete data but doesn’t apply to data that brokers collect from elsewhere.) The bill also would require data brokers to register with a recently formed “California Privacy Protection Agency” and disclose the types of data they collect.

According to the current draft of the bill, consumers would be able to delete their data through a website that would be housed by the California Privacy Protection Agency. The independent watchdog, established through CPRA, would have a deadline to create the website by January 2026 before becoming active later that year. The CPPA, which implements and enforces the state’s privacy laws, endorsed the Delete Act earlier this month. (The CPPA’s leadership team includes privacy experts, professors, lawyers and former regulators including the former CTO of the FTC).

By the middle of 2026, data brokers would be required to access the website at least once a month to process delete requests and fulfill any deletion requests within a month. The bill would also require data brokers to undergo a third-party audit every three years starting in 2028. Data brokers that don’t register with the state would be fined $200 each. Brokers that don’t comply with deletion requests would also be charged a fine of $200 each day for each deletion request.

The Delete Act still needs to pass several legislative hurdles. If state lawmakers want to pass the proposal this legislative session, SB 362 would need to pass the California Assembly by Sept. 14 and get a signature from Governor Gavin Newsom by Oct. 14.

Who supports it?

A variety of organizations are in support of the “Delete Act,” including the Privacy Rights Clearinghouse, one of the bill’s sponsors. Emory Roane, policy counsel for the Privacy Rights Clearinghouse, said the goal is to “harmonize” the Delete Act as much as possible with the CCPA and CPRA while fitting it into existing data-broker registration requirements. 

Proponents say the proposal provides important updates to protect consumers — especially when it comes to sensitive data. One of the first groups to endorse the bill was Planned Parenthood, given that location data related to abortion clinics has come under greater scrutiny.

“This is very much not a theoretical exercise anymore,” Roane said. “There are people that are dealing with not just discrimination but also threats to their personal safety, their livelihood, incarceration in other states. It’s important to understand the role that some of these data brokers can play in identity theft, discrimination and opening of other avenues of harm to the most vulnerable people among us.”

Other groups such as the Electronic Frontier Foundation have also endorsed SB 362. Hayley Tsukayama, associate director of legislative activism at EFF, said requiring consumers to know enough about data brokers and how to have their data deleted is a “high burden.” Describing the Delete Act as a “fairly modest proposal, but not a seismic shift,” she said the bill provides a practical fix to a “really thorny problem.”

“I understand how privacy and competition are intertwined,” Tsukayama said. “But I also think the data broker industry is so much less visible and vulnerable to public scrutiny.”

Who’s against it?

Advertising industry trade groups are putting increased pressure on California lawmakers to kill the bill and calling on various advertising and data broker companies to also put pressure on members of the California Assembly. For example, a website created by the Consumer Data Industry Association called “No to SB 362” lists reasons the organization thinks the bill could “harm California.” 

The ad industry groups against the “Delete Act” say the bill would hurt companies that rely on third-party data. Industry lobbyists also say the bill could give companies like Meta and Apple even more consolidated power, both because consumers know them better than data brokers and because it would lead advertisers to rely more on the giants’ ad platforms. Opponents also argue that data consumers rely on — such as for mortgages and anti-fraud mechanisms — might also be impacted by the law. 

In an interview about the bill, Chris Oswald, head of government relations for the Association of National Advertisers, told Digiday that it would be better to “kick it ahead” rather than rush passage at the end of the current legislative session so there’s time next year to work out definitions and various other parts.

“The bill is so sweeping,” Oswald said. “There are real consequences to the consumer that we don’t think consumers may fully comprehend or appreciate.”

In a recent letter to stakeholders, the ANA called on members to pressure California lawmakers. A copy of the letter, obtained by Digiday, said the bill could end up giving “self-interested companies” and “pay-to-play privacy services” more ways to submit data deletion requests on behalf of large groups of consumers.

Some advertising companies are also reportedly taking a data-driven approach to fight the “Delete Act.” According to Politico, Interpublic Group is coordinating a hyper-targeted opposition campaign using in-house digital advertising tools. When Digiday asked for comment from IPG, Thomas Cunningham, svp of global communications for the company, wrote in an email that the reports were “not accurate,” adding that the company is pushing for a national privacy law instead of state-by-state efforts.

“Acxiom joined others in the industry to offer our view to trade organizations and legislative bodies on why this proposal will damage the economy, negatively impacting both small and large businesses,” Cunningham explained. “While we oppose SB 362, we have not run a media campaign against it — nor do we have any plans to do so.”

If the ad-tech industry is actually using data to create a hyper-targeted campaign to stop the Delete Act, there’s an irony in the industry using the same tools that lawmakers want to restrain. 

“It really indicates there’s a problem that needs to be solved here,” Roane said. “We should be concerned collectively that there’s an industry with enough information on consumers to be able to target so effectively policy that would otherwise regulate them.”