Law / United States / 
California
AB 883 (2026), Delete Act: 30-day deletion cycle, and deletion requests of elected officials and judges
AB 883 (Ch. 507, Stats. 2026), Cal. Civ. Code Sections 1798.99.86 and 1798.99.86.5
A data brokers rule binding private bodies.
- Obligation class
- Data subject rights
As of .
What it requires
- If you are a data broker, access the California Privacy Protection Agency's accessible deletion mechanism at least once every 30 days, and within 30 days after receiving a deletion request through it, process the request and delete all personal information related to the consumer who made it (Civil Code Section 1798.99.86(c)(1)(A)).
- If you deny a deletion request because it cannot be verified, process it within 30 days of receiving it as an opt-out of the sale or sharing of the consumer's personal information (Section 1798.99.86(c)(1)(B)).
- After deleting a consumer's data under a request, delete all of that consumer's personal information again at least once every 30 days, unless the consumer requests otherwise or section 1798.99.86(c)(2) excuses the deletion (Section 1798.99.86(d)(1)).
- From , process a deletion request you receive from a state or local elected official or a judge by complying with Section 1798.99.86 and its implementing regulations (Section 1798.99.86.5(f), (i)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
California Privacy Protection Agency; for the personal information of an elected official or judge, the Attorney General, a county counsel or a city attorney may also bring a civil action on that person's behalf.
What this law does
AB 883 was chaptered on as Chapter 507 of the Statutes of 2026. It amends Section 1798.99.86 of the Civil Code and adds Section 1798.99.86.5 to it. It changes the 45-day period in the data broker's deletion duties to a 30-day period.
A data broker must access the California Privacy Protection Agency's accessible deletion mechanism at least once every 30 days and, within 30 days after receiving a request, process all deletion requests and delete all personal information related to the consumers making them. A data broker that denies a deletion request because it cannot be verified must process the request as an opt-out of the sale or sharing of the consumer's personal information within 30 days of receiving it.
After deleting a consumer's data, the data broker must delete all personal information of that consumer at least once every 30 days, unless the consumer requests otherwise or deletion is not required.
The Secretary of State, certain local government officials, the Judicial Council and the State Bar of California must notify state elected officials, local elected officials and judges, as applicable, that they may submit a request to delete their personal information through the accessible deletion mechanism.
The Attorney General, a county counsel or a city attorney may bring a civil action on behalf of a judge or elected official against a data broker that violates Section 1798.99.86 with respect to that person's personal information, for declaratory relief, injunctive relief, reasonable attorney's fees and actual damages.
A court may award punitive damages if it finds a data broker willfully violated Section 1798.99.86 with respect to the personal information of a notified judge or elected official. The provisions on notice and on civil actions for elected officials and judges become operative on .
Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for the amendments to Section 1798.99.86 is .
When LexLint raises it
When your app profile says your app crawls the web or tracks devices.