AMENDED IN SENATE AUGUST 21, 2026

AMENDED IN SENATE JUNE 17, 2026

AMENDED IN SENATE JUNE 3, 2026

AMENDED IN ASSEMBLY JANUARY 7, 2026

AMENDED IN ASSEMBLY JANUARY 5, 2026

AMENDED IN ASSEMBLY MARCH 24, 2025

CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION

93

Introduced by Assembly Member Lowenthal

(Coauthor: Assembly Member Bryan)

February 19, 2025

An act to amend Section 1798.99.86 of, and to add Section 1798.99.86.5 to, the Civil Code, relating to data brokers.

Vote: majority   Appropriation: no   Fiscal committee: yes   Local program: yes

LEGISLATIVE COUNSEL’S DIGEST

Existing law establishes the California Privacy Protection Agency (CPPA) to enforce various laws protecting the privacy of individuals. If a business knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, existing law requires the business to register with the CPPA as a data broker, except as specified. Existing law requires the CPPA to establish an accessible deletion mechanism that allows a consumer to request that every data broker delete any personal information related to that consumer held by the data broker or associated service provider or contractor, as prescribed. Existing law requires, beginning August 1, 2026, a data broker to access that deletion mechanism at least once every 45 days and, among other things, process all deletion requests and delete all personal information related to the consumers making the requests, as specified.

This bill would change the above-described 45-day period to a 30-day period and make conforming changes.

This bill would require the Secretary of State, certain local government officials, and the Judicial Council Council, and the State Bar of California to notify any state elected official, local elected official, or judge, as applicable, that the person may submit a request to delete that person’s personal information through the above-described accessible deletion mechanism, as prescribed. By imposing additional duties on local government officials, this bill would impose a state-mandated local program.

This bill would authorize an elected official or judge, or the Attorney General, a county counsel, or a city attorney on behalf of that elected official or judge, to bring a civil action action, on behalf of an elected official or judge, against a databroker data broker who violates certain personal information deletion requirements, as prescribed.

This bill would make its provisions relating to the notice and enforcement of requests for deletion of personal information of elected officials and judges operative on July 1, 2027.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

The people of the State of California do enact as follows:

SECTION 1.

Section 1798.99.86 of the Civil Code is amended to read:

1798.99.86.

(a) By January 1, 2026, the California Privacy Protection Agency shall establish an accessible deletion mechanism that does all of the following:

(1) Implements and maintains reasonable security procedures and practices, including, but not limited to, administrative, physical, and technical safeguards appropriate to the nature of the information and the purposes for which the personal information will be used and to protect consumers’ personal information from unauthorized use, disclosure, access, destruction, or modification.

(2) Allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or an associated service provider or contractor.

(3) Allows a consumer to selectively exclude specific data brokers from a request made under paragraph (2).

(4) Allows a consumer to make a request to alter a previous request made under this subdivision after at least 45 days have passed since the consumer last made a request under this subdivision.

(b) The accessible deletion mechanism established pursuant to subdivision (a) shall meet all of the following requirements:

(1) The accessible deletion mechanism shall allow a consumer to request the deletion of all personal information related to that consumer through a single deletion request.

(2) The accessible deletion mechanism shall permit a consumer to securely submit information in one or more privacy-protecting ways determined by the California Privacy Protection Agency to aid in the deletion request.

(3) The accessible deletion mechanism shall allow data brokers registered with the California Privacy Protection Agency to determine whether an individual has submitted a verifiable consumer request to delete the personal information related to that consumer as described in paragraph (1) and shall not allow the disclosure of any additional personal information when the data broker accesses the accessible deletion mechanism unless otherwise specified in this title.

(4) The accessible deletion mechanism shall allow a consumer to make a request described in paragraph (1) using an internet service operated by the California Privacy Protection Agency.

(5) The accessible deletion mechanism shall not charge a consumer to make a request described in paragraph (1).

(6) The accessible deletion mechanism shall allow a consumer to make a request described in paragraph (1) in any language spoken by any consumer for whom personal information has been collected by data brokers.

(7) The accessible deletion mechanism shall be readily accessible and usable by consumers with disabilities.

(8) The accessible deletion mechanism shall support the ability of a consumer’s authorized agents to aid in the deletion request.

(9) The accessible deletion mechanism shall allow the consumer, or their authorized agent, to verify the status of the consumer’s deletion request.

(10) The accessible deletion mechanism shall provide a description of all of the following:

(A) The deletion permitted by this section, including, but not limited to, the actions required by subdivisions (c) and (d).

(B) The process for submitting a deletion request pursuant to this section.

(C) Examples of the types of information that may be deleted.

(c) (1) Beginning August 1, 2026, a data broker shall access the accessible deletion mechanism established pursuant to subdivision (a) at least once every 30 days and do all of the following:

(A) Within 30 days after receiving a request made pursuant to this section, process all deletion requests made pursuant to this section and delete all personal information related to the consumers making the requests consistent with the requirements of this section.

(B) If a data broker denies a consumer request to delete under this title because the request cannot be verified, process the request as an opt-out of the sale or sharing of the consumer’s personal information, as provided for under Section 1798.120 and limited by Sections 1798.105, 1798.145, and 1798.146, within 30 days of receiving the request.

(C) Direct all service providers or contractors associated with the data broker to delete all personal information in their possession related to the consumers making the requests described in subparagraph (A).

(D) Direct all service providers or contractors associated with the data broker to process a request described by subparagraph (B) as an opt-out of the sale or sharing of the consumer’s personal information, as provided for under Section 1798.120 and limited by Sections 1798.105, 1798.145, and 1798.146.

(2) Notwithstanding paragraph (1), a data broker shall not be required to delete a consumer’s personal information if either of the following apply:

(A) It is reasonably necessary for the data broker to maintain the personal information to fulfill a purpose described in subdivision (d) of Section 1798.105.

(B) The deletion is not required pursuant to Section 1798.145 or 1798.146.

(3) Personal information described in paragraph (2) shall only be used for the purposes described in paragraph (2) and shall not be used or disclosed for any other purpose, including, but not limited to, marketing purposes.

(d) (1) Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall delete all personal information of the consumer at least once every 30 days pursuant to this section unless the consumer requests otherwise or the deletion is not required pursuant to paragraph (2) of subdivision (c).

(2) Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall not sell or share new personal information of the consumer unless the consumer requests otherwise or selling or sharing the personal information is permitted under Section 1798.145 or 1798.146.

(e) (1) Beginning January 1, 2028, and every three years thereafter, a data broker shall undergo an audit by an independent third party to determine compliance with this section.

(2) For an audit completed pursuant to paragraph (1), the data broker shall submit a report resulting from the audit and any related materials to the California Privacy Protection Agency within five business days of a written request from the California Privacy Protection Agency.

(3) A data broker shall maintain the report and materials described in paragraph (2) for at least six years.

(f) (1) The California Privacy Protection Agency may charge an access fee to a data broker when the data broker accesses the accessible deletion mechanism pursuant to subdivision (c) that does not exceed the reasonable costs of providing that access.

(2) A fee collected by the California Privacy Protection Agency pursuant to paragraph (1) shall be deposited in the Data Brokers’ Registry Fund.

SEC. 2.

Section 1798.99.86.5 is added to the Civil Code, to read:

1798.99.86.5.

(a) (1) The Secretary of State shall notify any state elected official that the elected official may submit a request to delete that person’s personal information pursuant to Section 1798.99.86 through the accessible deletion mechanism described in Section 1798.99.86.

(2) A filing officer, as defined in Section 82027 of the Government Code, for a local government shall notify any local elected official within the filing officer’s jurisdiction that the elected official may submit a request to delete that person’s personal information pursuant to Section 1798.99.86 through the accessible deletion mechanism described in Section 1798.99.86.

(3) Following the certification of a final election, the Secretary of State and any filing officer for a local government shall comply with paragraph (1) or (2), as applicable, with respect to each newly elected official within their respective jurisdictions.

(b) (1) The Judicial Council shall notify any California judge judge, other than a State Bar Court judge, that the judge may submit a request to delete the judge’s personal information pursuant to Section 1798.99.86 through the accessible deletion mechanism described in Section 1798.99.86.

(2) The Judicial Council shall comply with paragraph (1) after the appointment or election of any additional judge with respect to that judge.

(d) (1) The California Privacy Protection Agency shall create informational material detailing how state and local elected officials and judges can utilize the accessible deletion mechanism described in Section 1798.99.86.

(2) Upon the creation of the informational material required by paragraph (1), the California Privacy Protection Agency shall communicate the informational material to the Secretary of State, filing officers, officers, the State Bar of California, and the Judicial Council.

(3) The Secretary of State, filing officers, officers, the State Bar of California, and the Judicial Council may comply with the notice requirements of this section by providing the informational material required by paragraph (1) to elected officials and judges.

(e) The deletion of personal information under this section shall be subject to the limitations provided in Sections 1798.105, 1798.145, and 1798.146.

(f) A data broker shall process a deletion request received pursuant to this section by complying with Section 1798.99.86 and its implementing regulations.

The Attorney General, a county counsel, or a city attorney on behalf of that elected official or judge, may bring a civil action action, on behalf of a judge or elected official, against a data broker who violates Section 1798.99.86 with respect to the personal information of that judge or elected official for any of the following relief:

(1) Declaratory relief.

(2) Injunctive relief.

(3) Reasonable attorney’s fees.

(4) Actual damages.

(g) In addition to the other relief provided under this section, if a court finds that a data broker willfully violated Section 1798.99.86 with respect to the personal information of a judge or elected official notified pursuant to this section, the court may award punitive damages.

(h) For purposes of this section, “judge” means a superior court judge, appellate justice, or justice of the Supreme Court. Court, or State Bar Court judge.

(i) This section shall become operative on July 1, 2027.

SEC. 3.

If the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code.