Bill Text: CA AB883 | 2025-2026 | Regular Session | Amended
Bill Title: Data brokers: accessible deletion mechanism: deletion of personal information of elected officials and judges.
Sponsorship: Partisan Bill (Democrat 2)
Status: (Engrossed) 2026-08-13 - Read second time. Ordered to third reading. [AB883 Detail]
Download: California-2025-AB883-Amended.html
|
Amended
IN
Senate
June 17, 2026 |
|
Amended
IN
Senate
June 03, 2026 |
|
Amended
IN
Assembly
January 07, 2026 |
|
Amended
IN
Assembly
January 05, 2026 |
|
Amended
IN
Assembly
March 24, 2025 |
CALIFORNIA LEGISLATURE—
2025–2026 REGULAR SESSION
Assembly Bill
No. 883
| Introduced by Assembly Member Lowenthal (Coauthor: Assembly Member Bryan) |
February 19, 2025 |
An act to amend Section 1798.99.86 of, and to add Section 1798.99.86.5 to to, the Civil Code, relating to data brokers.
LEGISLATIVE COUNSEL'S DIGEST
AB 883, as amended, Lowenthal.
Data brokers: accessible deletion mechanism: deletion of personal information of elected officials and judges.
Existing law establishes the California Privacy Protection Agency (CPPA) to enforce various laws protecting the privacy of individuals. If a business knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, existing law requires the business to register with the CPPA as a data broker, except as specified. Existing law requires the CPPA to establish an accessible deletion mechanism that allows a consumer to request that every data broker delete any personal information related to that consumer held by the data broker or associated service provider or contractor, as prescribed. Existing law requires, beginning August 1, 2026, a data broker to access that deletion mechanism at least once every 45 days and, among other
things, process all deletion requests and delete all personal information related to the consumers making the requests, as specified.
This bill would change the above-described 45-day period to a 30-day period and make conforming changes.
This bill would create an additional process for the deletion of personal information of state and local government officials and California judges held by data brokers. In this regard, the bill would require the Secretary of State, certain local government officials, and the Judicial Council to provide to the CPPA lists of certain personal information of all
notify any
state elected officials, all official, local elected officials, official, or all California judges, respectively, and would require elected officials and judges to be provided an opportunity to remove their information from those lists, as prescribed. The bill would require the lists to be kept confidential, as specified. judge, as applicable, that the person may submit a request to delete that person’s personal information through the above-described
accessible deletion mechanism, as prescribed. By imposing additional duties on local government officials, this bill would impose a state-mandated local program. The bill would require the CPPA to upload the lists to the accessible deletion mechanism described above and would require data brokers to delete that personal information within 10 days.
This bill would authorize an elected official or judge who is on a list described above, judge, or the Attorney General, a county counsel, or a city attorney on behalf of that elected official or judge,
to bring a civil action for a violation of the bill, against a databroker who violates certain personal information deletion requirements, as prescribed.
This bill would make its provisions relating to the notice and enforcement of requests for deletion of personal information of elected officials and judges operative on July 1, 2027.
Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.
This bill would make
legislative findings to that effect.
The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers the constitutional requirements relating to this purpose.
This bill would make legislative findings to that effect.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
Digest Key
Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YESBill Text
The people of the State of California do enact as follows:
SECTION 1.
Section 1798.99.86 of the Civil Code is amended to read:1798.99.86.
(a) By January 1, 2026, the California Privacy Protection Agency shall establish an accessible deletion mechanism that does all of the following:(1) Implements and maintains reasonable security procedures and practices, including, but not limited to, administrative, physical, and technical safeguards appropriate to the nature of the information and the purposes for which the personal information will be used and to protect consumers’ personal information from unauthorized use, disclosure, access, destruction, or modification.
(2) Allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or
an associated service provider or contractor.
(3) Allows a consumer to selectively exclude specific data brokers from a request made under paragraph (2).
(4) Allows a consumer to make a request to alter a previous request made under this subdivision after at least 45 days have passed since the consumer last made a request under this subdivision.
(b) The accessible deletion mechanism established pursuant to subdivision (a) shall meet all of the following requirements:
(1) The accessible deletion mechanism shall allow a consumer to request the deletion of all personal information related to that consumer through a single deletion request.
(2) The accessible deletion mechanism shall permit a consumer to securely submit information in one or more privacy-protecting ways determined by the California Privacy Protection Agency to aid
in the deletion request.
(3) The accessible deletion mechanism shall allow data brokers registered with the California Privacy Protection Agency to determine whether an individual has submitted a verifiable consumer request to delete the personal information related to that consumer as described in paragraph (1) and shall not allow the disclosure of any additional personal information when the data broker accesses the accessible deletion mechanism unless otherwise specified in this title.
(4) The accessible deletion mechanism shall allow a consumer to make a request described in paragraph (1) using an internet service operated by the California Privacy Protection Agency.
(5) The accessible deletion mechanism shall not charge a consumer to make a request described in paragraph (1).
(6) The accessible deletion mechanism shall allow a consumer to make a request described in paragraph (1) in any
language spoken by any consumer for whom personal information has been collected by data brokers.
(7) The accessible deletion mechanism shall be readily accessible and usable by consumers with disabilities.
(8) The accessible deletion mechanism shall support the ability of a consumer’s authorized agents to aid in the deletion request.
(9) The accessible deletion mechanism shall allow the consumer, or their authorized agent, to verify the status of the consumer’s deletion request.
(10) The accessible deletion mechanism shall provide a description of all of the following:
(A) The deletion permitted by this section, including, but not limited to, the actions required by subdivisions (c) and (d).
(B) The process for submitting a deletion request pursuant to this section.
(C) Examples of the types of information that may
be deleted.
(c) (1) Beginning August 1, 2026, a data broker shall access the accessible deletion mechanism established pursuant to subdivision (a) at least once every 45
30 days and do all of the following:
(A) Within 45 30 days after receiving a request made pursuant to this section, process all deletion requests made pursuant to this section and delete all personal information related to the consumers making the requests consistent with the requirements of this section.
(B) In cases where If a data broker denies a consumer request to delete under this title because the request cannot be verified, process the request as an opt-out of the sale or sharing of the consumer’s personal information, as
provided for under Section 1798.120 and limited by Sections 1798.105, 1798.145, and 1798.146, within 45
30 days of receiving the request.
(C) Direct all service providers or contractors associated with the data broker to delete all personal information in their possession related to the consumers making the requests described in subparagraph (A).
(D) Direct all service providers or contractors associated with the data broker to process a request described by subparagraph (B) as an opt-out of the sale or sharing of the consumer’s personal information, as provided for under Section 1798.120 and limited by Sections 1798.105, 1798.145, and 1798.146.
(2) Notwithstanding paragraph (1), a data broker shall not be required to delete a consumer’s personal information if either of the following apply:
(A) It is reasonably necessary for the data broker to maintain the personal information to fulfill a purpose described in subdivision (d) of Section 1798.105.
(B) The deletion is not required pursuant to Section 1798.145 or 1798.146.
(3) Personal information described in paragraph (2) shall only be used for the purposes described in paragraph (2) and shall not be used or disclosed for any other purpose, including, but not limited to, marketing purposes.
(d) (1) Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall delete all personal information of the consumer at least once every 45
30 days pursuant to this section unless the consumer requests otherwise or the deletion is not required pursuant to paragraph (2) of subdivision (c).
(2) Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall not sell or share new personal information of the consumer unless the consumer requests otherwise or selling or sharing the personal information is permitted under Section 1798.145 or 1798.146.
(e) (1) Beginning January 1, 2028, and every three years thereafter, a data broker shall undergo an audit by an independent third party to determine compliance with this section.
(2) For an audit completed pursuant to paragraph (1), the data broker shall submit a report resulting from the audit and any related materials to the California Privacy
Protection Agency within five business days of a written request from the California Privacy Protection Agency.
(3) A data broker shall maintain the report and materials described in paragraph (2) for at least six years.
(f) (1) The California Privacy Protection Agency may charge an access fee to a data broker when the data broker accesses the accessible deletion mechanism pursuant to subdivision (c) that does not exceed the reasonable costs of providing that access.
(2) A fee collected by the California Privacy Protection Agency pursuant to paragraph (1) shall be deposited in the Data Brokers’ Registry Fund.
SECTION 1.SEC. 2.
Section 1798.99.86.5 is added to the Civil Code, to read:1798.99.86.5.
(a) (1)(B)
(2) A filing officer, as defined in Section 82027 of the Government Code, for a local government shall provide to the California Privacy Protection Agency a list of
all notify any local elected officials official within the filing officer’s jurisdiction that, if available, includes each official’s personal information. that the elected official may submit a request to delete that person’s personal information pursuant to Section 1798.99.86 through the accessible deletion mechanism described in Section 1798.99.86.
(2)Following the certification of a final election, the Secretary of State and any filing officer for a local government shall provide to the California Privacy Protection Agency a list of elected officials that includes the personal information provided pursuant to paragraph (1).
(3)The California Privacy Protection Agency shall provide each elected official an opportunity to request that the elected official’s name and profile data be removed from the list.
(4)
(3) Following the certification of a final election, the Secretary of State, State and any filing officer for a local government, and the California Privacy Protection Agency government shall comply with paragraphs paragraph (1) to (3), inclusive,
or (2), as applicable, with respect to each newly elected official within their respective jurisdictions.
(b) (1) The Judicial Council shall provide the California Privacy Protection Agency with a list of all notify any California judges, which shall serve as each judge’s judge that the judge may submit a request to delete the judge’s personal information pursuant to paragraph (1) of subdivision (b) of
Section 1798.99.86. The list shall include each judge’s name and other profile data, as defined by the California Privacy Protection Agency, that has been shared voluntarily by the judge.
1798.99.86 through the accessible deletion mechanism described in Section 1798.99.86.
(2)Before providing the list to the California Privacy Protection Agency, the Judicial Council shall provide each judge an opportunity to request that the judge’s personal information be removed from the list. The list submitted to the California Privacy Protection Agency shall include only those judges that did not request to be removed from the list.
(3)
(2) The Judicial Council shall provide an updated list comply with paragraph (1) after the appointment or election of any additional judge. judge
with respect to that judge.
(c)(1)After receipt of the lists required by this section, the California Privacy Protection Agency shall upload the lists required by this section to the accessible deletion mechanism established pursuant to Section 1798.99.86.
(2)(A)Notwithstanding subparagraph (A) of paragraph (1) of subdivision (c) of Section 1798.99.86, an entity required to delete, pursuant to Section 1798.99.86, the personal information of a person on a list uploaded pursuant to paragraph (1) shall delete that personal information within 10 days.
(c) (1) The California Privacy Protection Agency shall create informational material detailing how state and local elected officials and judges can utilize the accessible deletion mechanism described in Section 1798.99.86.
(2) Upon the creation of the informational material required by paragraph (1), the California Privacy Protection Agency shall communicate the informational material to the Secretary of State, filing officers, and the Judicial Council.
(3) The Secretary of State, filing officers, and the Judicial Council may comply with the notice requirements of this section by providing the informational material required by paragraph (1) to elected officials and judges.
(B)
(d) The deletion of personal information under this paragraph section shall be subject to the limitations provided in Sections 1798.105, 1798.145, and 1798.146.
(d)Any information shared pursuant to this section shall be shared in a secure and confidential exchange. The lists and the information in the lists shall be confidential and not subject to disclosure under the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code).
(e) A data broker shall process a deletion request received pursuant to this section by complying with Section 1798.99.86 and its implementing regulations.
(e)
(f) An elected official or judge who is on a list described in subdivision (a) or (b), was notified pursuant to this section, or the Attorney General, a county counsel, or a city attorney
on behalf of that elected official or judge, may bring a civil action for a violation of this section against a data broker who violates Section 1798.99.86 with respect to the personal information of that judge or elected official for any of the following relief:
(1) Declaratory relief.
(2) Injunctive relief.
(3) Reasonable attorney’s fees.
(4) Actual damages.
(f)
(g) In addition to the other relief provided under this section, if a court finds that an entity
a data broker willfully refused to provide for deletion as required under this section, violated Section 1798.99.86 with respect to the personal information of a judge or elected official notified pursuant to this section, the court may award punitive damages.
(h) For purposes of this section, “judge” means a superior court judge, appellate justice, or justice of the Supreme Court.
(g)
(i) This section shall become operative on July 1, 2027.
The Legislature finds and declares that Section 1 of this act, which adds Section 1798.99.86.5 to the Civil Code, imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
In order to protect the confidential and private information of an elected official or judge, it is necessary that this act limit the public’s right of access to that information.
The Legislature finds and declares that Section 1 of this act, which adds Section 1798.99.86.5 to the Civil Code, furthers, within the meaning of paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution, the purposes of that constitutional section as it relates to the right of public access to the meetings of local public bodies or the writings of local public officials and local agencies. Pursuant to paragraph (7) of subdivision (b) of Section 3 of Article I of
the California Constitution, the Legislature makes the following findings:
In order to protect the confidential and private information of local elected government officials, it is necessary that this act limit the public’s right of access to that information.
