Bill Full Text
Home
-
Bills
-
Bill
-
Authors
-
Dates
-
Locations
-
Analyses
-
Organizations
<?xml version="1.0" ?>
<ns0:MeasureDoc xmlns:html="http://www.w3.org/1999/xhtml" xmlns:ns0="http://lc.ca.gov/legalservices/schemas/caml.1#" xmlns:ns3="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="1.0" xsi:schemaLocation="http://lc.ca.gov/legalservices/schemas/caml.1# xca.1.xsd">
<ns0:Description>
<ns0:Id>20250SB__110699INT</ns0:Id>
<ns0:VersionNum>99</ns0:VersionNum>
<ns0:History>
<ns0:Action>
<ns0:ActionText>INTRODUCED</ns0:ActionText>
<ns0:ActionDate>2026-02-13</ns0:ActionDate>
</ns0:Action>
</ns0:History>
<ns0:LegislativeInfo>
<ns0:SessionYear>2025</ns0:SessionYear>
<ns0:SessionNum>0</ns0:SessionNum>
<ns0:MeasureType>SB</ns0:MeasureType>
<ns0:MeasureNum>1106</ns0:MeasureNum>
<ns0:MeasureState>INT</ns0:MeasureState>
</ns0:LegislativeInfo>
<ns0:AuthorText authorType="LEAD_AUTHOR">Introduced by Senator Cabaldon</ns0:AuthorText>
<ns0:Authors>
<ns0:Legislator>
<ns0:Contribution>LEAD_AUTHOR</ns0:Contribution>
<ns0:House>SENATE</ns0:House>
<ns0:Name>Cabaldon</ns0:Name>
</ns0:Legislator>
</ns0:Authors>
<ns0:Title> An act to amend Section 1798.99.86 of the Civil Code, relating to privacy.</ns0:Title>
<ns0:RelatingClause>privacy</ns0:RelatingClause>
<ns0:GeneralSubject>
<ns0:Subject>Data brokers.</ns0:Subject>
</ns0:GeneralSubject>
<ns0:DigestText>
<html:p>Existing law requires the California Privacy Protection Agency to establish an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or an associated service provider or contractor. Existing law requires, beginning August 1, 2026, a data broker to access that deletion mechanism at least once every 45 days and, among other things, process all deletion requests and delete all personal information related to the consumers making the requests, as specified.</html:p>
<html:p>This bill would change the above-described 45-day periods to 30-day periods.</html:p>
</ns0:DigestText>
<ns0:DigestKey>
<ns0:VoteRequired>MAJORITY</ns0:VoteRequired>
<ns0:Appropriation>NO</ns0:Appropriation>
<ns0:FiscalCommittee>YES</ns0:FiscalCommittee>
<ns0:LocalProgram>NO</ns0:LocalProgram>
</ns0:DigestKey>
<ns0:MeasureIndicators>
<ns0:ImmediateEffect>NO</ns0:ImmediateEffect>
<ns0:ImmediateEffectFlags>
<ns0:Urgency>NO</ns0:Urgency>
<ns0:TaxLevy>NO</ns0:TaxLevy>
<ns0:Election>NO</ns0:Election>
<ns0:UsualCurrentExpenses>NO</ns0:UsualCurrentExpenses>
<ns0:BudgetBill>NO</ns0:BudgetBill>
<ns0:Prop25TrailerBill>NO</ns0:Prop25TrailerBill>
</ns0:ImmediateEffectFlags>
</ns0:MeasureIndicators>
</ns0:Description>
<ns0:Bill id="bill">
<ns0:Preamble>The people of the State of California do enact as follows:</ns0:Preamble>
<ns0:BillSection id="id_6DB62927-6ECD-4F82-AD24-4B596B47FDA3">
<ns0:Num>SECTION 1.</ns0:Num>
<ns0:ActionLine action="IS_AMENDED" ns3:type="locator" ns3:href="urn:caml:codes:CIV:caml#xpointer(%2Fcaml%3ALawDoc%2Fcaml%3ACode%2Fcaml%3ALawHeading%5B%40type%3D'DIVISION'%20and%20caml%3ANum%3D'3.'%5D%2Fcaml%3ALawHeading%5B%40type%3D'PART'%20and%20caml%3ANum%3D'4.'%5D%2Fcaml%3ALawHeading%5B%40type%3D'TITLE'%20and%20caml%3ANum%3D'1.81.48.'%5D%2Fcaml%3ALawSection%5Bcaml%3ANum%3D'1798.99.86.'%5D)" ns3:label="fractionType: LAW_SECTION">
Section 1798.99.86 of the
<ns0:DocName>Civil Code</ns0:DocName>
is amended to read:
</ns0:ActionLine>
<ns0:Fragment>
<ns0:LawSection id="id_5AE3618B-3C1E-4D9E-ACB8-410B541C4956">
<ns0:Num>1798.99.86.</ns0:Num>
<ns0:LawSectionVersion id="id_40EF0CB3-2F54-4B7A-B1A0-8ACB81F93382">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
By January 1, 2026, the California Privacy Protection Agency shall establish an accessible deletion mechanism that does all of the following:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
Implements and maintains reasonable security procedures and practices, including, but not limited to, administrative, physical, and technical safeguards appropriate to the nature of the information and the purposes for which the personal information will be used and to protect consumers’ personal information from unauthorized use, disclosure, access, destruction, or modification.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
Allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal
information related to that consumer held by the data broker or
an associated service provider or contractor.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
Allows a consumer to selectively exclude specific data brokers from a request made under paragraph (2).
</html:p>
<html:p>
(4)
<html:span class="EnSpace"/>
Allows a consumer to make a request to alter a previous request made under this subdivision after at least 45 days have passed since the consumer last made a request under this subdivision.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
The accessible deletion mechanism established pursuant to subdivision (a) shall meet all of the following requirements:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
The accessible deletion mechanism shall allow a consumer to request the deletion of all personal information related to that consumer through a single deletion request.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
The
accessible deletion mechanism shall permit a consumer to securely submit information in one or more privacy-protecting ways determined by the California Privacy Protection Agency to aid in the deletion request.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
The accessible deletion mechanism shall allow data brokers registered with the California Privacy Protection Agency to determine whether an individual has submitted a verifiable consumer request to delete the personal information related to that consumer as described in paragraph (1) and shall not allow the disclosure of any additional personal information when the data broker accesses the accessible deletion mechanism unless otherwise specified in this title.
</html:p>
<html:p>
(4)
<html:span class="EnSpace"/>
The accessible deletion mechanism shall allow a consumer to make a request described in paragraph (1) using an internet service operated by the California Privacy Protection Agency.
</html:p>
<html:p>
(5)
<html:span class="EnSpace"/>
The accessible deletion mechanism shall not charge a consumer to make a request described in paragraph (1).
</html:p>
<html:p>
(6)
<html:span class="EnSpace"/>
The accessible deletion mechanism shall allow a consumer to make a request described in paragraph (1) in any language spoken by any consumer for whom personal information has been collected by data brokers.
</html:p>
<html:p>
(7)
<html:span class="EnSpace"/>
The accessible deletion mechanism shall be readily accessible and usable by consumers with disabilities.
</html:p>
<html:p>
(8)
<html:span class="EnSpace"/>
The accessible deletion mechanism shall support the ability of a consumer’s authorized agents to aid in the deletion request.
</html:p>
<html:p>
(9)
<html:span class="EnSpace"/>
The accessible deletion mechanism shall allow the consumer, or their authorized agent, to verify the status of the consumer’s deletion
request.
</html:p>
<html:p>
(10)
<html:span class="EnSpace"/>
The accessible deletion mechanism shall provide a description of all of the following:
</html:p>
<html:p>
(A)
<html:span class="EnSpace"/>
The deletion permitted by this section, including, but not limited to, the actions required by subdivisions (c) and (d).
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
The process for submitting a deletion request pursuant to this section.
</html:p>
<html:p>
(C)
<html:span class="EnSpace"/>
Examples of the types of information that may be deleted.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
Beginning August 1, 2026, a data broker shall access the accessible deletion mechanism established pursuant to subdivision (a) at least once every
30 days and do all of the following:
</html:p>
<html:p>
(A)
<html:span class="EnSpace"/>
Within 30 days after receiving a request made pursuant to this section, process all deletion requests made pursuant to this section and delete all personal information related to the consumers making the requests consistent with the requirements of this section.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
If a data broker denies a consumer request to delete under this title because the request cannot be verified, process the request as an opt-out of the
sale or sharing of the consumer’s personal information, as provided for under Section 1798.120 and limited by Sections 1798.105, 1798.145, and 1798.146, within
30 days of receiving the request.
</html:p>
<html:p>
(C)
<html:span class="EnSpace"/>
Direct all service providers or contractors associated with the data broker to delete all personal information in their possession related to the consumers making the requests described in subparagraph (A).
</html:p>
<html:p>
(D)
<html:span class="EnSpace"/>
Direct all service providers or contractors associated with the data broker to process a request described by subparagraph (B) as an opt-out of the sale or sharing of the consumer’s personal information, as provided for under Section 1798.120 and limited by Sections 1798.105, 1798.145, and 1798.146.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
Notwithstanding paragraph (1), a data broker shall not be required to delete a consumer’s personal information if either of the following apply:
</html:p>
<html:p>
(A)
<html:span class="EnSpace"/>
It is reasonably
necessary for the data broker to maintain the personal information to fulfill a purpose described in subdivision (d) of Section 1798.105.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
The deletion is not required pursuant to Section 1798.145 or 1798.146.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
Personal information described in paragraph (2) shall only be used for the purposes described in paragraph (2) and shall not be used or disclosed for any other purpose, including, but not limited to, marketing purposes.
</html:p>
<html:p>
(d)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall delete all personal information of the consumer at least once every
30 days pursuant to this section unless the consumer requests otherwise or the deletion is not required pursuant to paragraph (2) of subdivision (c).
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall not sell or share new personal information of the consumer unless the consumer requests otherwise or selling or sharing the personal information is permitted under Section 1798.145 or 1798.146.
</html:p>
<html:p>
(e)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
Beginning January 1, 2028, and every three years thereafter, a data broker shall undergo an audit by an independent third party to determine compliance with this section.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
For an audit completed pursuant to paragraph (1), the data broker shall
submit a report resulting from the audit and any related materials to the California Privacy Protection Agency within five business days of a written request from the California Privacy Protection Agency.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
A data broker shall maintain the report and materials described in paragraph (2) for at least six years.
</html:p>
<html:p>
(f)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
The California Privacy Protection Agency may charge an access fee to a data broker when the data broker accesses the accessible deletion mechanism pursuant to subdivision (c) that does not exceed the reasonable costs of providing that access.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
A fee collected by the California Privacy Protection Agency pursuant to paragraph (1) shall be deposited in the Data Brokers’ Registry Fund.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
</ns0:Fragment>
</ns0:BillSection>
</ns0:Bill>
</ns0:MeasureDoc>