Data brokers: accessible deletion mechanism.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer, as specified. The California Privacy Rights Act of 2020 (CPRA) , approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (CPPA) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. Existing law defines and requires the CPPA to regulate data brokers. Existing law, by January 1, 2026, requires the CPPA to establish an accessible deletion mechanism that meets certain requirements, including that it support the ability of a consumer's authorized agents to aid in the deletion request. This bill would impose additional requirements on the accessible deletion mechanism regarding authorized agents. In this regard, the bill would, among other things, require an authorized agent aiding in a deletion request to be registered with, and certified by, the CPPA, and would prohibit the authorized agent from charging the consumer a fee, as specified. The bill would also require the accessible deletion mechanism to include certain information for a data broker to directly contact the consumer requesting the deletion, and procedures to authenticate the identity of the consumer, as specified. Existing law requires a data broker, when denying a consumer's deletion request because the request cannot be verified, to process the request as an opt out of the sale or sharing of the consumer's personal information, as specified, and to direct all service providers or contractors associated with the data broker to process the request in the same way. This bill would recast that provision to instead authorize a data broker that denies a consumer request to delete because the request cannot be verified to ask if the consumer wants the data broker to process the request as an opt out, as specified. The bill would also authorize the data broker to deny the request if the data broker has a good faith, reasonable, and documented belief that the request is fraudulent, as specified, or if the request was submitted through an authorized agent who has not provided the consumer's signed permission demonstrating the agent's authority to act on the consumer's behalf. Existing law authorizes the CPPA to adopt regulations to implement and administer this title, as specified. This bill would instead require the CPPA to adopt those regulations on or before August 1, 2025. This bill would declare that it furthers the purposes and intent of the CPRA for specified reasons.