California Senate Bill 362 Passes Senate 32-8 and Moves to Assembly

[Update October 2023: the California Delete Act aka SB 362 was signed into law on October 10, 2023 by Governor Newsom. My analysis of the law can be found here.]

California Senate Bill 362 (SB 362) — the California Delete Act — today passed the California Senate 32-8 and now moves on to the Assembly. 

[Full disclosure: I proposed this bill to State Senator Josh Becker and co-drafted the bill along with the Privacy Rights Clearinghouse.]

The bill would create an online portal for consumers to request that data brokers delete any data they have on the consumer and no longer track them. By giving Californians the ability to go to a single, user-friendly portal (ala the FTC’s Do Not Call registry) to facilitate this, the ability for consumers to take control of their personal data takes a giant leap forward. The alternative — that is neither practical nor feasible — is that Californians must individually go to 100s of data broker websites and make a deletion request AND then do that again a few months later to reflect the capture of any new data by data brokers (with each iteration equaling 100s of hours per consumer).

It was certainly helpful that reproductive rights groups — such as Planned Parenthood Affiliates of California and Access Reproductive Justice — threw their support behind SB 362 as they see SB 362 as a means to limit the weaponization of reproductive healthcare data. SB 362 is also of significant value to immigrants and also domestic violence survivors.

But at the end of the day, this bill adds value to everyone. This is because we live in a world where shadowy data brokers collect all our online activity and merge it with our credit purchase history, property records, location data, and more. And anyone with a credit card can buy this information about us, and unfortunately, that data can be weaponized against us and get insight into our sexuality, reproductive health, and even our precise geolocation. Data brokers also profile and score us, which is then used by others to make crucial decisions impacting our lives, such as loans, housing, jobs, etc., despite the underlying data being incorrect half the time.

As I wrote in my booking Containing Big Tech regarding digital surveillance:

“Historically this near-total digital surveillance has enabled those companies to profile us and utilize this deep insight to let advertisers target us. But now, this data and behavioral analysis can be weaponized against us if, for example, you facilitate or get an abortion in certain US states. Or it can be used by adversarial nation-states to attack our democracy. Furthermore, the massive amounts of data collected by these Big Tech firms and the digital advertising ecosystem they facilitate can expose millions of people to identity theft every year.”

Roots of SB 362

This new bill is modeled after various calls for the Federal Trade Commission (FTC) to create a data broker registry and further allow consumers to make global deletion requests of data brokers in the registry. For example, Apple CEO Tim Cook proposed in a 2019 TIME magazine opinion piece that the FTC should establish a “data-broker clearinghouse.” This would facilitate consumers being able to track the data brokers “that have bundled and sold their data from place to place.” And the clearinghouse would also give consumers “the power to delete their data on demand, freely, easily and online, once and for all.”

A bipartisan federal proposal came out in February of 2022 to provide such a data-broker clearinghouse. Introduced by US Senators Bill Cassidy (Republican Senator from Louisiana) and Jon Ossoff (Democratic Senator from Georgia) and Representative Lori Trahan (Democratic House member from Massachusetts), the bill is the Data Elimination and Limiting Extensive Tracking and Exchange (DELETE) Act. The bill would “direct the Federal Trade Commission (FTC) to create an online dashboard for Americans to submit a one-time data deletion request that would be sent to all data brokers registered.” In addition, it would also create a “do-not-track list” to protect registrants from future data collection. Underpinning this proposal is the creation of a federal data broker registry.

Many people also see SB 362 as comparable to the FTC’s incredibly popular “Do Not Call” registry (operated by the Federal Trade Commission with over 240 million registrants). But instead of not having telemarketers call us, this would have a similar registration page but would tell data brokers to delete our data and no longer track us.

NEXT STEPS FOR SB 362

The bill moves to the Assembly where it will be reviewed by Committee on Privacy and Consumer Protection.