Delete Act

Data brokers now have to register with the California Privacy Protection Agency, and in August, these brokers started processing requests from regular people to delete all personal data.

I just Googled California Delete Act to find the form, and the request form lists a bunch of stuff that I can get deleted.

Info like my name, birthday, phone number, address, email, political party, my hobbies, brands I like, any biometrics, like my thumbprint or my face.

Okay, well, this seems pretty helpful.

This is one of those topics I know a lot of people are curious to hear about.

This platform came out of a state law called the California Delete Act, and that was something your organization, the Electronic Frontier Foundation, pushed for.

So why do you feel this tool is important?

Yeah, so I think, you know, we, as I said, we were, as you said, we were one of a member of a coalition that really pushed for this bill, sponsored by our friends at the Privacy Rights Clearinghouse, because we pushed for strong California privacy law.

And to make sure that people had a right to know sort of, you know, what companies were collecting about them and had some control over what to do with it.

But as the law went into effect, we realized, actually, these rights are really hard to use.

And so the idea behind the Delete Act was to have a tool that anyone could use.

So you could submit a bunch of requests at once rather than having to go from company to company immediately.

California promised consumers an easier way to protect their personal data.

Since 2024, the DELETE Act has required the state registration of data brokers, businesses that collect and sell personal data from our digital footprints.

It also mandates they give consumers a way to request their data be deleted and report how many requests they get.

But a new Stanford report shows registered data brokers are largely ignoring the laws.

We haven't yet seen the investigations around the types of activities we highlighted, but they are definitely starting at least with the folks that were obligated to be on the registry and who did not actually register.

Now, for this research, you were looking at compliance before the newest phase of California privacy law rolled out this year.

The Delete Act set up basically this one-stop shop where consumers can make these requests to all the data brokers at once using something called the DROP system, Delete Request and Opt Out platform.

Why is this so important?

Cloud providers and chip companies are competing less on basic access now and more on speed, model choice, and how quickly businesses can put advanced AI into everyday work.

On the regulatory front, California’s Delete Act has moved into active enforcement.

Registered data brokers now have to honor deletion and opt out requests through one central system instead of making people chase down company after company.

That’s a meaningful shift for US privacy law because it turns consumer control into something more practical.