California Tightens Data Broker Deletion Rules
Governor Newsom approved AB 883 on September 27, 2026, to accelerate the removal of personal data.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Should data brokers be held to stricter state-mandated timelines for processing personal data removal requests?
California Governor Gavin Newsom signed AB 883 into law on September 27, 2026, to amend state requirements for data brokers. The legislation mandates that brokers process deletion requests more rapidly to enhance privacy protections.
Why it matters
The new law streamlines the process for citizens to remove their personal information from broker databases. By enforcing stricter timelines, California aims to bolster data security for its residents.
Data brokers are now required to access the state's Delete Request and Opt-Out Platform every 30 days. They must subsequently process data removal requests within 30 days of platform access, down from the previous 45-day deadline.
The players
Gavin Newsom
Gavin Newsom is the Governor of California who signed AB 883 into law.
The details
The law authorizes the Attorney General, county counsel, or city attorney to file civil actions against companies for non-compliance. Additionally, courts are empowered to award punitive damages for willful violations of the data removal mandates.
Timeline
September 27, 2026: California Governor Gavin Newsom approved AB 883.
July 1, 2027: Notification requirements for elected officials and judges begin.
The Tech Race
This legislation builds upon the state's existing Delete Request and Opt-Out Platform to close gaps in consumer data protection. It signals a shift toward more aggressive state-level oversight in the broader technological battle over personal privacy.
Residents can expect faster processing times when requesting the deletion of their personal information from data broker platforms. Elected officials and judges will also gain specific protections through mandated notifications starting next year.
The takeaway
The act establishes a firm 30-day compliance window for data brokers to manage user requests. This change emphasizes the state's commitment to limiting the circulation of sensitive personal information.
What happens next
Government agencies must begin notifying elected officials and judges of their right to delete personal information on July 1, 2027.
Further reading
For broader context on digital security mandates, visit Cybersecurity.
Source note: This article includes information reported by Hunton.
Live Poll
Should data brokers be held to stricter state-mandated timelines for processing personal data removal requests?
