Californians are more aware than most when it comes to the privacy problems associated with tech giants headquartered in their backyard, like Apple, Google, Meta, and TikTok. However, lurking in the shadows is the overlooked data broker industry, which has become a multibillion-dollar business, primarily motivated by the collection and sale of everyone’s personal data.
When the California Legislature cannonballed the privacy conversation in 2018 by passing the California Consumer Privacy Act, or CCPA, it created a wave that continues to rise to this day. California’s bold leap, combined with the continued inaction of Congress, has inspired many states to take up the cause themselves, with baseline privacy rights extended to more than 100 million Americans through comprehensive state laws.
However, even with the CCPA and other state privacy laws, there are still blind spots that leave consumers unprotected. Fortunately, California has taken another big step in solving this problem by passing the Delete Act. California is now the first state in the country to allow consumers to request the universal deletion of their information from data brokers.
This new law, Senate Bill 362, will essentially reign in the shadowy data broker industry that has so far largely avoided scrutiny. Data vendors make money by collecting and selling highly detailed personal details about individuals, often without our knowledge or consent.
These companies know an incredible amount of information about us, including our online behavior (did you put that Nutella in your shopping cart?), our preferences (do you go camping on the weekend or on a beach bum?), our income and addresses (past and present), and—thanks to the ubiquitous tracking of mobile devices—even our precise movements throughout the day.
This information is sold and resold, often to entities such as social media companies or advertisers, but also possibly to ex-spouses, law enforcement, or others who may have an interest in tracking you.
Data brokers collect such information by buying it from companies (or buying the companies themselves), scraping it from online or public information sources, or even inferring it through machine learning techniques. That’s right. Even if a data broker is missing some piece of information about you, they can only guess at it, sometimes with imprecise endings.
Since consumers often do not have direct contact with data brokers, they may not even know that these entities exist, let alone that they have detailed dossiers on them with countless points of data.
The Delete Act would help consumers regain some semblance of control over a largely unregulated industry. Most importantly, its protections actually work.
Now, in theory, you could ask each individual data broker to stop selling your information. But how do you know who really has it? Even if you know all the relevant brokers, Consumer Reports finds it too burdensome and confusing to exercise your rights this way.
Instead of this wild goose chase, the Delete Act makes things easy for consumers. Similar to authorized agents and universal opt-out signals under the CCPA, the law encourages the California Privacy Protection Agency to create a universal opt-out mechanism that would allow consumers to send a request to remove all registered data brokers in the state with one click of a button. If you don’t want to be tracked in the way described above, all you have to do is set your preference once, and the brokers will have to honor it until you tell them to stop.
That’s a choice everyone should make. When the universal deletion mechanism becomes active in 2026, data brokers should prepare to look for higher ground because the California privacy wave is coming—this time for them.
Matt Schwartz is a policy analyst at Consumer Reports. He wrote this commentary for CalMatters.
