Cybersecurity Policy Report, Legislation to Update Data Broker Requirements Sent to Gov. Newsom, (Sep 23, 2025)
A bill that would require data brokers in the state to disclose additional information regarding their data-collection practices has been sent to California Gov. Gavin Newsom (D.) for his signature.
SB 361 would require data brokers to provide additional information to the state, including whether a broker collects consumers’ login or account information, various government identification numbers including Social Security or passport numbers, drivers’ license information, citizenship data, union membership, sexual orientation data, gender identity and gender expression data, and biometric data. It would specifically require a data broker to disclose whether it collects consumers’ account login information or account numbers in combination with any required security code, access code, or password that would enable access to a consumer’s account by a third party.
The bill further requires data brokers to report if they have, in the past year, shared or sold consumers’ data to a foreign actor, the federal government, other state governments, law enforcement, or the developer of an artificial intelligence system or model.
The bill would introduce penalties for noncompliance, including fines of $200 per day for failing to register or delete information as required, with recovered fines intended to offset state court and agency costs.
The bill would also require a data broker to process an opt-out request within 45 days of receiving the request. The bill points out that prior to Jan. 1, 2026, the California Privacy Protection Agency is required to establish an accessible deletion mechanism that allows a consumer to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor.
Sen. Josh Becker (D.), author of the bill (S.B. 361, Reg Sess.), said the measure was intended to increase transparency about data brokers to help people protect the privacy of their personal information.
“There are serious concerns that data brokers are selling sensitive information in ways that could lead to surveillance and targeting of vulnerable communities, including immigrants, and LGBTQ+ individuals. The risks of mass deportation, discrimination, and other harmful outcomes are real, and we must act to protect people’s privacy,” Sen. Becker said.
News: StateLegislation DataPrivacy