California Consumer Privacy Act of 2018: data broker registration: accessible deletion mechanism.

Defines 'direct relationship' as requiring a consumer to have intentionally interacted with a business for the purpose of obtaining information about, accessing, purchasing, using, or requesting its products or services. A business does not have a direct relationship merely because it collects personal information directly from a consumer, and does not have one as to data sold that was collected outside a first-party interaction.

Defines 'first party' as a consumer-facing business with which the consumer intends and expects to interact.

Defines 'foreign actor' as the government of a foreign adversary country or an entity organized under the laws of or having its principal place of business in a foreign adversary country (using the definition of 'covered nation' from 10 U.S.C. 4872).

Defines 'developer of a GenAI system' as any entity that designs, codes, produces, or substantially modifies a generative artificial intelligence system, and defines 'GenAI system' as AI that can generate synthetic content (text, images, video, audio) emulating the structure and characteristics of its training data.

Data brokers must disclose whether they sell inferences about consumer attributes based on analysis of sensitive categories including minors' personal information, citizenship data (including immigration status), union membership, sexual orientation, gender identity/expression, and reproductive health care data.

Data brokers must disclose whether they shared or sold consumer data in the past year to: foreign actors, the federal government, other state governments, law enforcement (unless pursuant to subpoena or court order), or a developer of a GenAI system or model.

Data brokers must provide a link to a webpage detailing how consumers can exercise all CCPA privacy rights (deletion, correction, access, sale/sharing disclosure, opt-out, limit sensitive PI use) and that page must not use dark patterns.

Beginning August 1, 2026, data brokers must access the deletion mechanism at least once every 45 days, process all deletion requests within 45 days, and if a request cannot be verified, process it as an opt-out of sale or sharing. After a consumer's data is deleted, the broker must continue deleting all of that consumer's personal information at least once every 45 days and may not sell or share new personal information of that consumer unless the consumer requests otherwise.

Entirely new Section 1798.99.87.1 creates a privacy preference profile tool that allows consumers to define and store preferences regarding data broker practices. The tool categorizes each registered data broker as 'consistent,' 'inconsistent,' or 'indeterminate' based on the broker's most recent registration disclosures. Indeterminate brokers are treated as inconsistent by default. Consumers can exclude consistent brokers from deletion requests, and the tool notifies consumers when a previously consistent broker materially changes its disclosed practices.

By January 1, 2026, the California Privacy Protection Agency must establish an accessible deletion mechanism allowing a consumer to delete their personal information from all registered data brokers through a single verifiable request.

Beginning January 1, 2028, and every three years thereafter, data brokers must undergo an independent third-party audit to determine compliance with the deletion mechanism requirements. Reports must be submitted to the CPPA within five business days of a written request and maintained for at least six years.

Data brokers that fail to register are liable for $200 per day plus fees due during the non-registration period plus reasonable investigation expenses. Data brokers that fail to comply with deletion requirements are liable for $200 per deletion request per day plus reasonable expenses. All penalties are deposited in the Data Brokers' Registry Fund.

A data broker whose registration is found by the agency to be systematically incomplete with respect to information material to the privacy preference profile tool may be subject to enforcement under Section 1798.99.84 for failure to make required disclosures.

The bill's scope expanded from amending only Section 1798.130 (consumer request submission methods) to amending Sections 1798.99.80, 1798.99.82, and 1798.99.86 and adding new Section 1798.99.87.1, creating a full data broker registration, disclosure, deletion, consumer preference, audit, and enforcement framework.

Creates the Data Brokers' Registry Fund within the State Treasury to receive registration fees, access fees, and all penalties/fines/expenses recovered in enforcement actions, with the intent that they offset costs incurred by state courts and the CPPA.