California residents can use new tool to demand brokers delete their personal data

In a significant move towards enhancing data privacy, California has introduced a new platform aimed at empowering residents to take control of their personal information. This initiative comes as part of the state's ongoing efforts to combat the rampant activity of data brokers who collect and sell consumer data without consent. Since 2020, Californians have had the legal right to request that companies cease their data collection and sales practices. However, the previous process was cumbersome, requiring individuals to opt out on a case-by-case basis with numerous companies. The recently passed Delete Act of 2023 sought to streamline this process, allowing residents to submit a single request to over 500 registered data brokers to eliminate their personal information. The new tool, called the Delete Requests and Opt-Out Platform (DROP), provides a user-friendly interface for residents to make these requests. After verifying their residency, users can submit a deletion request that will be forwarded to all current and future data brokers operating within the state. However, it’s important to note that not all data will be deleted instantly. Data brokers are mandated to begin processing these requests by August 2026, after which they have a 90-day window to complete the deletions and report back to the users. If brokers fail to delete the requested data, residents can provide additional details to help locate their records. It’s also worth mentioning that companies may retain first-party data collected directly from users. The obligation to delete falls primarily on brokers who trade in personal data, which can encompass sensitive details such as social security numbers, browsing histories, email addresses, and phone numbers. Certain types of information, including vehicle registrations and voter records, are exempt from deletion as they are derived from public documents. Additionally, sensitive medical information may be protected under existing regulations like HIPAA. The California Privacy Protection Agency anticipates that this new tool will not only give residents greater authority over their personal data but also reduce the influx of unsolicited communications, such as unwanted texts, calls, or emails. Furthermore, it aims to mitigate the risks associated with identity theft, fraud, and potential data breaches. For data brokers that neglect to comply with registration or deletion requirements, the agency has outlined penalties of $200 per day, alongside enforcement expenses.