SB1104 - California Consumer Privacy Act of 2018: data broker registration: accessible deletion mechanism.

Amended IN Senate April 23, 2026 Amended IN Senate April 09, 2026 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Senate Bill No. 1104 Introduced by Senator Cabaldon February 13, 2026 An act to amend Sections 1798.99.80, 1798.99.82, 1798.99.86, and 1798.130 of, and to add Section 1798.99.87.1 to, 1798.99.80 and 1798.99.82 of the Civil Code, and to add Section 12815.5 to the Government Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGEST SB 1104, as amended, Cabaldon. California Consumer Privacy Act of 2018: data broker registration: accessible deletion mechanism. Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants to a consumer various rights with respect to personal information that is collected by a business. Existing law generally requires businesses to make certain methods of communication available for consumers to submit personal information requests, including requests for deletion or correction. Existing law requires a business that does not operate exclusively online to make available to consumers at least 2 methods for submitting personal information requests, including, at a minimum, a toll-free telephone number and, if the business maintains an internet website, a website address. This bill would require that a business that does not operate exclusively online make available to consumers an email address for submitting personal information requests. Existing law, the California Privacy Rights Act of 2020 (CPRA), an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. Existing law requires a data broker to register with the agency, and defines “data broker” to mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. This bill would define a “direct relationship” as, among other things, when a consumer has intentionally interacted with a business for the purpose of obtaining information about, accessing, purchasing, using, or requesting the business’s products or services. The bill would provide that specify circumstances when a data broker does not have a “direct relationship” relationship,” including if it sells personal information outside of a “first-party” interaction with the consumer. The bill would define a “first party” as a consumer-facing business with which the consumer intends and expects to interact. Existing law requires a data broker, in registering with the agency, to provide specified information, including, among other things, whether the data broker collects the personal information of minors or a consumer’s reproductive health care data. Existing law requires the agency to establish an accessible deletion mechanism that, among other things, allows a consumer to request that a specified data broker delete any personal information related to that consumer held by the data broker or associated service provider or contractor. This bill would require a data broker to provide additional information to the agency regarding whether the data broker sells inferences about the attributes of the consumer based on their analysis of specified data, including the personal information of minors and a consumer’s reproductive health care data. Existing law requires the agency to establish an accessible deletion mechanism that, among other things, allows a consumer to request that a specified data broker delete any personal information related to that consumer held by the data broker or associated service provider or contractor. Existing law establishes the Office of Data and Innovation (office) within the Government Operations Agency with a mission to deliver better government services to the people of California through technology and service innovation, data, and design. This bill would require the agency office to establish an online tool a privacy preference tool to enable a consumer to define and store a privacy preference profile regarding data broker data collection and use practices. practices, among other things. The bill would require the tool to, among other things, identify and categorize registered data brokers whose practices are consistent or inconsistent with a consumer’s privacy preferences based on a data broker’s most recent registration disclosures to the agency. evaluate relevant privacy, data management, and practice and policies against the consumer’s preference profile. The bill would require the office to make the online tool available to other state agencies, including the agency. The bill would require the tool to permit the exclusion of brokers categorized as consistent from a deletion request, as provided, and would require the agency to store consumer profiles and notify consumers of specific data broker registration changes. The bill would authorize specified enforcement on a data broker who provides systematically incomplete information material to the privacy preference profile tool. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill Text The people of the State of California do enact as follows: SECTION 1. Section 1798.99.80 of the Civil Code is amended to read: 1798.99.80. For purposes of this title: (a) The definitions in Section 1798.140 shall apply unless otherwise specified in this title. (b) “Authorized agent” has the same meaning as used in Chapter 1 (commencing with Section 7000) of Division 6 of Title 11 of the California Code of Regulations. (c) “Data broker” means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. “Data broker” does not include any of the following: (1) An entity to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.). (2) An entity to the extent that it is covered by the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations. (3) An entity to the extent that it is covered by the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code). (4) An entity, or a business associate of a covered entity, to the extent their processing of personal information is exempt under Section 1798.146. For purposes of this paragraph, “business associate” and “covered entity” have the same meanings as defined in Section 1798.146. (d) “Direct relationship” means that a consumer has intentionally interacted with a business for the purpose of obtaining information about, accessing, purchasing, using, or requesting the business’s products or services. (1) A “direct relationship” requires a consumer to intend to interact with the business. (2) A business does not have a “direct relationship” with a consumer because it collects personal information directly from the consumer. (2) A consumer does not have a “direct relationship” with a business if the purpose of their engagement is to exercise any right described under Section 1798, or for the business to verify the consumer’s identity. (3) A business does not have a “direct relationship” with a consumer as to personal information it sells about the consumer that it collected outside of a first-party interaction with the consumer. (e) “First party” means a consumer-facing business with which the consumer intends and expects to interact. SEC. 2. Section 1798.99.82 of the Civil Code is amended to read: 1798.99.82. (a) On or before January 31 following each year in which a business meets the definition of data broker as provided in this title, the business shall register with the California Privacy Protection Agency pursuant to the requirements of this section. (b) In registering with the California Privacy Protection Agency, as described in subdivision (a), a data broker shall do all of the following: (1) Pay a registration fee in an amount determined by the California Privacy Protection Agency, not to exceed the reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84 and the reasonable costs of establishing, maintaining, and providing access to the accessible deletion mechanism described in Section 1798.99.86. Registration fees shall be deposited in the Data Brokers’ Registry Fund, created within the State Treasury pursuant to Section 1798.99.81, and used for the purposes outlined in this paragraph. (2) Provide the following information: (A) The name of the data broker and its primary physical, email, and internet website addresses. (B) The metrics compiled pursuant to paragraphs (1) and (2) of subdivision (a) of Section 1798.99.85. (C) Whether the data broker collects the personal information of minors and whether the data broker sells inferences about the attributes of the consumer based on their analysis of the personal information of minors. (D) Whether the data broker collects consumers’ names, dates of birth, ZIP Codes, email addresses, or telephone phone numbers. (E) Whether the data broker collects consumers’ account login or account number in combination with any required security code, access code, or password that would permit access to a consumer’s account with a third party. (F) Whether the data broker collects consumers’ drivers’ license number, California identification card number, tax identification number, social security number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual. (G) Whether the data broker collects consumers’ mobile advertising identification numbers, connected television identification numbers, or vehicle identification numbers (VIN). (H) Whether the data broker collects consumers’ citizenship data and whether the data broker sells inferences about the attributes of the consumer based on their analysis of the consumer’s citizenship data, including immigration status. (I) Whether the data broker collects consumers’ union membership status and whether the data broker sells inferences about the attributes of the consumer based on their analysis of the consumer’s union membership. (J) Whether the data broker collects consumers’ sexual orientation status and whether the data broker sells inferences about the attributes of the consumer based on their analysis of the consumer’s sexual orientation. (K) Whether the data broker collects consumers’ gender identity and gender expression data and whether the data broker sells inferences about the attributes of the consumer based on their analysis of the consumer’s gender identity and gender expression. (L) Whether the data broker collects consumers’ biometric data. (M) Whether the data broker collects consumers’ precise geolocation. (N) Whether the data broker collects consumers’ reproductive health care data and whether the data broker sells inferences about the attributes of the consumer based on their analysis of the consumer’s reproductive health care data. (O) Whether the data broker has shared or sold consumers’ data to a foreign actor in the past year. (P) Whether the data broker has shared or sold consumers’ data to the federal government in the past year. (Q) Whether the data broker has shared or sold consumers’ data to other state governments in the past year. (R) Whether the data broker has shared or sold consumers’ data to law enforcement in the past year, unless that data was shared pursuant to a subpoena or court order. (S) Whether the data broker has shared or sold consumers’ data to a developer of a GenAI system or model in the past year. (T) Up to three, but no fewer than one, of the most common types of personal information that the data broker collects, if the data broker does not collect the information described in subparagraphs (D) and (G). (U) Beginning January 1, 2029, whether the data broker has undergone an audit as described in subdivision (e) of Section 1798.99.86, and, if so, the most recent year that the data broker has submitted a report resulting from the audit and any related materials to the California Privacy Protection Agency. (V) A link to a page on the data broker’s internet website that does both of the following: (i) Details how consumers may exercise their privacy rights by doing all of the following: (I) Deleting personal information, as described in Section 1798.105. (II) Correcting inaccurate personal information, as described in Section 1798.106. (III) Learning what personal information is being collected and how to access that personal information, as described in Section 1798.110. (IV) Learning what personal information is being sold or shared and to whom, as described in Section 1798.115. (V) Learning how to opt out of the sale or sharing of personal information, as described in Section 1798.120. (VI) Learning how to limit the use and disclosure of sensitive personal information, as described in Section 1798.121. (ii) Does not make use of any dark patterns. (W) Whether and to what extent the data broker or any of its subsidiaries is regulated by any of the following: (i) The federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.). (ii) The Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations. (iii) The Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code). (iv) The Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) or the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191). (X) Any additional information or explanation the data broker chooses to provide concerning its data collection practices. (c) A data broker that fails to register as required by this section is liable for administrative fines and costs in an administrative action brought by the California Privacy Protection Agency as follows: (1) An administrative fine of two hundred dollars ($200) for each day the data broker fails to register as required by this section. (2) An amount equal to the fees that were due during the period it failed to register. (3) Reasonable expenses incurred by the California Privacy Protection Agency in the investigation and administration of the action. ( [Text truncated for display. Full text available on Congress.gov.]