Cybersecurity Policy Report, Legislation to Speed Data Deletion Requests Advances in California, (Apr 21, 2026)
The California state Senate Appropriations Committee voted this week to pass a bill that would shorten the required timeframe for data brokers to access the accessible deletion mechanism provided by the California Privacy Protection Agency (CalPrivacy) and process consumer deletion requests.
Last year, the state adopted a law to implement a “deletion mechanism” to allow consumers to request the deletion of their personal information held by data brokers and associated service providers or contractors. Current law requires data brokers to process requests within 45 days.
SB 1106 would accelerate the timeline for data brokers to process consumer data deletion requests to 30 days.
Beginning Aug. 1, data brokers would have to comply with the new 30-day timeline for processing deletion requests, direct service providers to do the same, and stop selling or sharing new personal information of consumers who have submitted deletion requests unless otherwise permitted by law, according to the bill.
The bill also would require, starting Jan. 1, 2028, data brokers to undergo independent audits every three years to ensure compliance, with audit reports to be retained for six years and submitted to CalPrivacy upon request.
The bill (S.B. 1106, Reg Sess.) is sponsored by Sen. Christopher Cabaldon (D.).
News: StateLegislation DataPrivacy CCPA