CA SB361: Data brokers: data collection and deletion.

In one paragraph

California's SB 361 expands what data brokers must report when registering with the California Privacy Protection Agency. Registrations must say whether the broker collects data such as account logins, government ID numbers, citizenship or immigration status, union membership, sexual orientation, gender identity or biometric data, and whether in the past year it shared or sold consumers' data to a developer of a generative AI system or model, a foreign actor, governments or law enforcement. Signed October 8, 2025 (Chapter 466); effective January 1, 2026.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

Data brokers must disclose in their annual CPPA registration whether they sold or shared consumer data with generative AI developers, foreign actors, governments or law enforcement in the past year, plus new categories of data collected.

Key provisions

1. 1Amends the Delete Act data broker provisions (Civil Code §§ 1798.99.82, 1798.99.84 and 1798.99.86); data brokers register with the California Privacy Protection Agency by January 31 following each year they meet the definition
2. 2Registrations must state whether the broker has shared or sold consumers' data to a developer of a GenAI system or model in the past year; a GenAI developer is an entity that designs, codes, produces or substantially modifies AI that generates synthetic text, images, video or audio emulating its training data
3. 3Registrations must also state whether in the past year it shared or sold data to a foreign actor (a foreign adversary government or entity), the federal government, other state governments, or law enforcement (unless under a subpoena or court order)
4. 4New collection disclosures: names, dates of birth, ZIP Codes, email addresses or phone numbers; account logins with access codes; government ID numbers; mobile advertising, connected-TV or vehicle IDs; citizenship data including immigration status; union membership; sexual orientation; gender identity and expression; and biometric data
5. 5Brokers that collect neither the basic identifiers (names, birth dates, ZIP Codes, emails, phone numbers) nor advertising, connected-TV or vehicle IDs must list one to three of their most common types of personal information; the agency may not post the identifier answers or those types on its public website
6. 6As amended, failure to register costs $200 a day plus unpaid fees and the agency's costs, and failure to meet deletion duties $200 per deletion request per day plus costs; unverifiable deletion requests must be processed as opt-outs of sale or sharing within 45 days
7. 7Signed by the Governor October 8, 2025 (Chapter 466, Statutes of 2025); effective January 1, 2026

Latest legislative action

Oct 8, 2025. Chaptered by Secretary of State. Chapter 466, Statutes of 2025.

Sponsors (showing 5 of 26)

Roll call votes (showing 3 of 6)