California Governor Gavin Newsom signs into law the Delete Act, which requires data brokers to delete a state resident's personal info after a single request
Californians will be able to make a single request asking that data brokers delete their personal information, under a bill Gov. Gavin Newsom signed into law on Tuesday.
Context & Ripple Effects
The Delete Act is an early building block in California’s expanding data-rights framework: it targets the intermediary businesses that aggregate and trade personal information rather than only the consumer-facing services that collect it.
Later coverage shows that framework moving from statutory rights toward usable controls, including a state-run deletion-request tool for registered data brokers, browser-level opt-outs of third-party data sales, and protections for neural data as sensitive personal information.
First-order effects
- Data brokers serving California residents must establish a way to honor a resident’s deletion instruction through a single request, shifting compliance work from individuals to the broker ecosystem.
- Californians gain a consolidated route to seek removal of personal information held by multiple brokers, rather than pursuing each company separately.
Second-order effects
- Companies that buy or rely on brokered audience and identity data may need stronger visibility into whether upstream data remains available after deletion requests.
- A single-request mechanism raises the value of interoperable deletion and identity-matching processes for brokers, while reducing the utility of data that cannot be reliably updated or removed.
Third-order effects
- If implementation is effective, privacy rights increasingly become operational infrastructure—centralized request channels, broker registries, and standardized downstream compliance—not merely disclosures and opt-out forms.
- California’s approach points toward a broader data-rights stack in which deletion, sale opt-outs, and new sensitive-data categories are managed as connected controls; the extent of spillover will depend on enforcement and adoption beyond the state.
The trend: Consumer privacy policy is shifting from notice-and-choice toward centralized, enforceable controls over how personal data moves through intermediary markets.