Law / United States / 
California
Data broker registration and request metrics (Delete Act)
Also known as Delete Act.
Cal. Civ. Code sections 1798.99.80 to 1798.99.85
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- Licensing, Disclosure, Reporting
- Audit expectation
- none
As of .
What it requires
- Register with the California Privacy Protection Agency on or before January 31 following each year in which you are a data broker (you knowingly collect and sell to third parties the personal information of consumers you have no direct relationship with), and pay the registration fee the Agency sets.
- You are not a data broker to the extent the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the Insurance Information and Privacy Protection Act covers you, or your processing is exempt under Civil Code section 1798.146.
- In the registration, give your name and primary physical, email and website addresses and your request metrics, and say whether you collect minors' personal information; names, dates of birth, ZIP Codes, email addresses or phone numbers; account logins or account numbers with the codes that unlock them; government identification numbers; mobile advertising, connected television or vehicle identification numbers; citizenship or immigration data; union membership; sexual orientation; gender identity or expression; biometric data; precise geolocation; or reproductive health care data. If you collect none of the names, dates of birth, ZIP Codes, email addresses or phone numbers, and none of the mobile advertising, connected television or vehicle identification numbers, name one to three of the most common types of personal information you collect.
- Also state in the registration whether in the past year you shared or sold consumers' data to a foreign actor, the federal government, other state governments, law enforcement (except under a subpoena or court order) or a developer of a generative artificial intelligence system or model; whether and to what extent you or a subsidiary is regulated by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Insurance Information and Privacy Protection Act, the Confidentiality of Medical Information Act or the federal Health Insurance Portability and Accountability Act (HIPAA) privacy, security and breach notification rules; and, beginning , whether you have undergone the independent audit of your deletion compliance and the most recent year you submitted its report to the Agency.
- Link in the registration to a page on your website, free of dark patterns, that explains how consumers can delete and correct their personal information, learn what you collect and how to access it, learn what you sell or share and to whom, opt out of its sale or sharing, and limit the use and disclosure of their sensitive personal information.
- By July 1 each year, disclose in the privacy policy posted on your website, and through a link included in that policy, how many deletion, access, opt-out and limit requests you received, complied with in whole or in part, and denied in the previous calendar year, and the median and mean number of days you took to respond substantively. For deletion requests made through the Agency's accessible deletion mechanism, give how many you denied because the request was not verifiable, was not made by a consumer, called for exempt information or for other reasons. For every deletion request, give how many each provision of section 1798.145 or 1798.146 excused, in whole or in part.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civ. Code section 1798.99.82(c): an administrative fine of $200 for each day the data broker fails to register, plus an amount equal to the fees due during that period and the Agency's reasonable expenses of investigation and administration, in an administrative action brought by the California Privacy Protection Agency. Section 1798.99.89 bars an administrative action commenced more than five years after the violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 200
Over one month of continuous breach, USD 6,088.
Who enforces it
Enforcement body
California Privacy Protection Agency, in an administrative action (Civil Code section 1798.99.82(c)). The title creates no private right of action.
What this law does
A data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship, excluding an entity to the extent the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the Insurance Information and Privacy Protection Act covers it, or to the extent its processing is exempt under Civil Code section 1798.146.
Each data broker must register with the California Privacy Protection Agency on or before January 31 following each year in which it meets that definition, and pay a registration fee.
The registration states the broker's contact details; whether it collects minors' personal information, precise geolocation, biometric data, reproductive health care data and other listed categories; whether in the past year it shared or sold consumers' data to a foreign actor, the federal government, other state governments, law enforcement (outside a subpoena or court order) or a developer of a generative artificial intelligence system or model; and a link to a page explaining how consumers exercise their California Consumer Privacy Act rights.
By July 1 each year, a data broker must also disclose in its privacy policy how many consumer-rights requests it received, complied with and denied in the previous calendar year, and the median and mean number of days it took to respond. A data broker that fails to register is liable in an administrative action by the Agency for a fine of $200 for each day, the fees due for that period and the Agency's expenses.
The title does not supersede or interfere with the operation of the California Consumer Privacy Act. An administrative action under it must be commenced within five years of the violation.
When LexLint raises it
When your app profile says your app crawls the web or tracks devices.