Consumer Data Deletion Movement Brewing in Statehouses?

Two years ago, California enacted first-of-its-kind legislation allowing residents to demand that data brokers delete the personal information the brokers have collected about them.

Known as the California Delete Act, SB 362, by Sen. Josh Becker (D), provided for the data equivalent of the do-not-call registry. The bill called for the creation of a website where Californians could submit a single request to have their data deleted by all registered data brokers in the state.

“The Delete Act is based on a very simple premise: Every Californian should be able to control who has access to their personal information and what they can do with it,” Becker said in a May 2023 press release about the bill.

Californians won’t be able to start having their data deleted until next year. But regulators in the state have already begun taking enforcement action against data brokers to make sure they comply with the law, including fining one $46,000 for failing to register on time. And lawmakers in other states appear to be paying attention.

States Follow California’s Lead on Data Deletion

This year bills similar to the California Delete Act have been introduced in Illinois (HB 2913), Nebraska (LB 602) and Vermont (HB 211 and SB 70).

All of the bills require data brokers to register with the state and provide for the establishment of a “deletion mechanism” that “allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any brokered personal information” about that consumer delete their personal information.

The bills are directly linked to the California legislation through Tom Kemp, a Silicon Valley policy advisor and author who has consulted on all of them, as well as helped Becker develop California’s Delete Act.

After the California bill was signed into law, Kemp predicted on his website that it would “have national reverberations with consumers and policymakers, acting as a great precedent that other states will likely be inclined to follow, as Californians at the Christmas or Thanksgiving dinner circa 2026 will be telling their out-of-state relatives about their ability to delete their data from data brokers, and no doubt non-Californians will want the same.”

The only thing Kemp got wrong was the timing. SB 362 is already having national reverberations, reflecting the public’s discomfort with faceless data brokers that collect and scrape personal information from online and offline sources and then aggregate it for sale to third parties.

Trio of States Considering Consumer Data Deletion Bills

So far this year, three states have introduced bills that would allow residents to request that data brokers delete the personal information the brokers have collected about them according to the LexisNexis® State Net® legislative tracking system. California, which became the first state to enact such legislation two years ago, is also considering a measure that would require data brokers to provide additional information about the data they collect from consumers.

Data Deletion Bills Target Other Concerns about Data Brokers

The Illinois, Nebraska and Vermont data deletion measures, like California’s Delete Act, also require data brokers to notify consumers and government agencies of data breaches, to disclose the type of data they collect, and certify that they will only use the data for a legitimate purpose.

“The proliferation of sensitive information exchanged in the data broker marketplace, often without consumers’ knowledge or consent, harms consumer privacy,” the Consumer Financial Protection Bureau said in a fact sheet about a proposed rule late last year aimed at limiting data brokers’ ability to sell personal information. “Sensitive consumer information can be used to target certain consumers for identity theft, fraud, or predatory scams, or other harmful purposes.”

The Electronic Privacy Information Center, otherwise known as EPIC, likewise, reports that there are thousands of data brokers in the United States that have “enormous financial incentives” to collect individuals’ data but little reason to protect it. “For these companies, consumers are the product, not the customer,” the organization says on its website, where it calls for tougher regulations of the burgeoning industry.

If the state data deletion bills are any indication, this sort of sentiment is growing across the country. Expect more legislative activity on the issue in the future.

—By SNCJ Correspondent BRIAN JOSEPH

Visit our webpage to connect with a LexisNexis® State Net® representative and learn how the State Net legislative and regulatory tracking service can help you identify, track, analyze and report on relevant legislative and regulatory developments.