Disclaimer: This page provides general informational summaries only and does not constitute legal advice. AI-generated content may contain errors. Always consult a qualified attorney for guidance specific to your situation.
Read full disclaimer →
AI Summary
SB362 mandates data brokers in California to establish a deletion mechanism for consumer data and comply with registration requirements, enhancing consumer privacy rights.
Business Impact
If you operate as a data broker in California, you must register with the California Privacy Protection Agency by January 31 each year or face fines.
What do these statuses mean? ▼
Introduced
— Filed in the legislature; not yet heard in committee
In Committee
— Assigned to and being reviewed by a legislative committee
Passed
— Approved by one or both chambers; awaiting further action
Signed / Enacted
— Signed into law by the governor; may or may not be in effect yet
Dead / Vetoed
— Vetoed, failed to pass, or session expired without action
Unknown
— Status data not yet available or awaiting classification
Affected Industries
Topics How we classify →
What This Means
California's SB362 introduces new requirements for data brokers, including a mechanism for consumers to request the deletion of their personal information. The bill aims to enhance consumer privacy rights and holds data brokers accountable for compliance. Businesses must adapt to these regulations to avoid penalties.
Key Provisions
- Data brokers must register with the California Privacy Protection Agency annually by January 31.
- An accessible deletion mechanism for consumer data must be established by January 1, 2026.
- Data brokers are required to disclose metrics related to consumer data requests annually.
- The Data Brokers’ Registry Fund will be used to support enforcement and operational costs.
- Data brokers must undergo an independent audit every three years starting January 1, 2028.
- Data brokers must access the deletion mechanism at least once every 45 days starting August 1, 2026.
- Data brokers must delete all personal information of the consumer at least once every 45 days after a deletion request.
- Data brokers are prohibited from selling or sharing new personal information of the consumer after a deletion request.
Latest Legislative Action
Chaptered by Secretary of State. Chapter 709, Statutes of 2023.
Bill Sponsors (showing 5 of 7)
| Name | Role | District |
|---|---|---|
| Buffy Wicks D | Sponsor | HD-014 |
| Dave Min D | Sponsor | SD-037 |
| Gregg Hart D | Sponsor | HD-037 |
| Jesse Gabriel D | Sponsor | HD-046 |
| Josh Becker D | Sponsor | SD-013 |
Roll Call Votes (showing 3 of 8)
S ·
Unfinished Business SB362 Becker et al. Concurrence ·
Sep 14, 2023
31 Yea
9 Nay
Passed ✓
A ·
SB 362 Becker Senate Third Reading By Gabriel ·
Sep 13, 2023
52 Yea
14 Nay
14 Other
Passed ✓
A ·
Do pass as amended ·
Sep 1, 2023
10 Yea
3 Nay
3 Other
Passed ✓
Compliance Checklist
Register with the California Privacy Protection Agency and pay the registration fee.
Who: Data brokers operating in California.
Deadline: By January 31 each year.
Penalty: $200 per day for failure to register.
Who: Data brokers operating in California.
Deadline: By January 31 each year.
Penalty: $200 per day for failure to register.
Establish an accessible deletion mechanism for consumer data.
Who: Data brokers.
Deadline: By January 1, 2026.
Penalty: Administrative fines for non-compliance.
Who: Data brokers.
Deadline: By January 1, 2026.
Penalty: Administrative fines for non-compliance.
Related & Companion Bills
Full Legal Analysis
SB362 amends existing provisions in the Civil Code concerning data brokers, shifting registration responsibilities from the Attorney General to the California Privacy Protection Agency (CPPA). It requires data brokers to establish an accessible deletion mechanism by January 1, 2026, allowing consumers to request the deletion of their personal information through a single request. Data brokers must access the deletion mechanism at least once every 45 days starting August 1, 2026, and delete all personal information of the consumer at least once every 45 days after a deletion request. Additionally, data brokers are prohibited from selling or sharing new personal information of the consumer after a deletion request. Data brokers must also compile and disclose metrics related to consumer requests annually. Non-compliance can result in administrative fines and costs, reinforcing the importance of adhering to these new regulations. The bill aligns with the broader objectives of the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), enhancing consumer control over personal data.
Official Source
Official Bill Text
View SB362 on official legislature website →
Related Topics
Affected Industries
More California AI Legislation
SB59
Change of name or gender and sex identifier.
Low
SB348
State Air Resources Board: Low Carbon Fuel Standard.
Medium
AB976
Personal Income Tax Law: Corporation Tax Law: California Retail Secur…
Low
AB 1979
Health care services: artificial intelligence.
High
AB 2545
Report: labor force impact: artificial intelligence.
Medium
AB2545
Report: labor force impact: artificial intelligence.
Medium
View All CA Laws →
More California AI Laws
Browse all published AI bills and regulations for California.