California added another legal arrow to its quiver of privacy laws Tuesday after Gov. Gavin Newsom, D-Calif., signed Senate Bill 362, colloquially referred to as the Delete Act, into law. The move comes just days before the 14 Oct. deadline for Newsom to sign the bill. 

The Delete Act follows on the heels of the California Consumer Privacy Act and amendments to the landmark legislation made by California Privacy Rights Act. The new law requires data brokers to register with the California Privacy Protection Agency, which will enforce the law.

Significantly, the CPPA will also be charged with developing a one-stop-shop mechanism by 1 Jan. 2026 for consumers who are securely verified to request the deletion and tracking of their personal data. Starting 1 Aug. 2026, brokers will also be required to process new deletion requests within 45 days of receiving a verified request.

Under current provisions, consumers can opt to have data brokers delete their data with an individual request to each company. There are roughly 500 so-called data brokers doing business in the state.  

State Sen. Josh Becker, D-Calif., who wrote SB 362, said Newsom’s signature “enshrines California as a leader in consumer privacy.” He added, “Data brokers possess thousands of data points on each and everyone of us, and they currently sell reproductive healthcare, geolocation and purchasing data to the highest bidder. The Delete Act protects our most sensitive information.”