On October 11, 2023, California Governor Gavin Newsom (D) signed into law SB 362, the “Delete Act.”  Among other requirements, the law updates the state’s existing data broker registry law to mandate that “data brokers” honor deletion requests made through a centralized “accessible deletion mechanism.” When utilized by a consumer, the data deletion mechanism would effectively delete data from hundreds of companies that provide very different products and services to the marketplace, either on their own or through an authorized agent. As written, an authorized agent could be anyone (i.e.) Apple, Consumer Reports, Chrome, DuckDuckGo etc., and there are no safeguards included to prevent authorized agents from abusing their role in the system. This centralized deletion mechanism will be stood up and administered by the California Privacy Protection Agency (CPPA), which regulates the state’s privacy laws and Age Appropriate Design Code law.  The law will take effect on January 1, 2026, and registered “data brokers” will be required to access the mechanism at least once every 45 days beginning on August 1, 2026. 

...