Data brokers: data collection and deletion.

The bill now amends three Civil Code sections (1798.99.82, 1798.99.84, and 1798.99.86) instead of just Section 1798.99.82, substantially expanding the bill's reach to include a new public transparency section and an entirely new deletion mechanism section.

A new accessible deletion mechanism is established: the CPPA must create it by January 1, 2026; data brokers must access it at least once every 45 days starting August 1, 2026; deletion requests must be processed within 45 days; denied deletion requests must be treated as opt-outs of sale or sharing within 45 days; and data brokers must continue deleting every 45 days after an initial deletion unless the consumer requests otherwise.

Data brokers must now disclose whether they collect consumers' names, dates of birth, ZIP Codes, email addresses, or phone numbers, as well as mobile advertising identification numbers, connected television identification numbers, or vehicle identification numbers (VINs).

Data brokers must disclose up to three (but no fewer than one) of the most common types of personal information they collect, if they do not collect the information covered by the new name/DOB/ZIP/email/phone and mobile advertising/CTV/VIN categories.

The requirement to disclose whether data was shared with law enforcement now includes an exception: disclosure is not required if the data was shared pursuant to a subpoena or court order.

The definition of 'foreign actor' is narrowed from any 'foreign country' to a 'foreign adversary country,' specifically defined by reference to 'covered nation' in Section 4872 of Title 10 of the U.S. Code. This limits the disclosure requirement to data shared with governments or entities in countries designated as adversaries.

The term 'developer of an AI system or model' is replaced with 'GenAI system,' and a new definition is added: 'Generative artificial intelligence system' means an AI that can generate derived synthetic content (text, images, video, audio) emulating the structure and characteristics of its training data.

A new provision prohibits the CPPA from making certain registration information publicly accessible on its website, specifically the data about names/DOB/ZIP/email/phone collection, mobile advertising/CTV/VIN numbers, and the most common types of personal information collected.

The administrative fine provision for failure to register is modified from 'Expenses incurred by the CPPA' to 'Reasonable expenses incurred by the CPPA,' adding a reasonableness limitation on recoverable costs.

Independent third-party audits of data broker compliance with the deletion mechanism are required beginning January 1, 2028, and every three years thereafter, with reports submitted to the CPPA within five business days of a written request and maintained for at least six years.

Reformatted from an official chaptered document layout (with page numbers, state header, and printed formatting) to a web page display format with navigation menus, search tools, and metadata panels.

Added bill metadata including version history dates (09/13/25 Enrolled through 02/13/25 Introduced), vote type (MAJORITY), appropriation status (NO), fiscal committee designation (YES), and local program status (NO).

Removed the official 'STATE OF CALIFORNIA AUTHENTICATED ELECTRONIC LEGAL MATERIAL' header and printed page number formatting.

The bill was assigned Chapter 466 and the approval date of October 8, 2025 was added, replacing the blank 'received by the Governor' line from the enrolled version.

Senate and Assembly passage certifications (dates, Secretary of the Senate and Chief Clerk signatures) were removed as part of the standard chaptering process.

Page numbers were renumbered from starting at 95 (enrolled) to starting at 94 (chaptered), and page headers changed from 'SB 361' to 'Ch. 466.'

Data brokers must now disclose whether they shared or sold consumers' data in the past year to a foreign actor, the federal government, other state governments, law enforcement, or a developer of an AI system or model.

New definition of 'foreign actor' covering both foreign governments and entities organized under foreign laws or having their principal place of business in a foreign country.

New definition of 'developer of an AI system or model' covering any entity that designs, codes, produces, or substantially modifies an AI model or system.

Existing disclosure items were relettered (M through P became R through U) to accommodate the five new disclosure items inserted as M through Q.

Data brokers must now disclose whether they collect consumers' gender identity and gender expression data, adding it as a new item in the list of personal information categories subject to mandatory disclosure at registration.

All subsections following the new gender identity/gender expression item were re-lettered (biometric data moved from I to J, precise geolocation from J to K, reproductive health care data from K to L, audit requirement from L to M, website link from M to N, federal/state regulation disclosure from N to O, and additional information from O to P).

Page numbering changed from 99 to 98 throughout the bill, reflecting a pagination adjustment.