This law section defines certain terms used in the title. Specifically, it outlines what a 'data broker' is, describing them as businesses that collect and sell personal information without a direct relationship with the consumer. It also specifies that several entities, such as those covered by certain federal acts like the Fair Credit Reporting Act, are not considered 'data brokers.' Additionally, the terms from another law section will apply unless stated otherwise here, and 'authorized agent' references a specific regulatory definition.

This law section creates a special fund called the “Data Brokers’ Registry Fund” to handle money collected by California's Privacy Protection Agency and the Department of Justice. This money will be used to cover the costs of setting up and running a website about data brokers, enforcing the rules, and managing a system that lets people delete their data, all under the permission of the state legislature.

This section outlines the requirements for businesses that qualify as data brokers to register annually with the California Privacy Protection Agency. They must provide specific information, such as their name, contact details, and whether they collect certain types of personal information. Data brokers also need to disclose if they undergo audits, offer a way for consumers to exercise privacy rights, and avoid using 'dark patterns'—tricks that mislead users. Failing to register results in daily fines and other penalties. The law ensures that registration fees and penalties support the regulation costs.

The California Privacy Protection Agency is required to set up a public webpage where people can access the registration details of data brokers and find a way to request the deletion of their data.

This law requires businesses that qualify as data brokers to compile reports on how many data requests they received, how they responded to them, and how quickly they responded. They need to include these details in their online privacy policy. The reports must break down requests they denied and explain why, such as if a request was unverifiable or involved information exempt from deletion. They also have to specify, for certain legal exemptions, when they did not delete data in response to a request.

Starting January 1, 2026, the California Privacy Protection Agency needs to set up a system that makes it easy for people to request the deletion of their personal data from data brokers. This system must keep the data secure, allow consumers to request deletions from multiple brokers with one request, and let them track and change their requests. It should be accessible to all, including in different languages and for people with disabilities.

Data brokers must check this system every 45 days starting August 1, 2026, to process deletion requests and stop selling any new personal information unless the consumer agrees otherwise. They don’t have to delete data if they need it for specific legal reasons. Additionally, from 2028, brokers have to undergo audits every three years to verify compliance, and they might have to pay a fee to access this deletion system.

This law allows the California Privacy Protection Agency to create rules to implement privacy laws, following a specific process called the Administrative Procedure Act. However, if the agency wants to set fees under these privacy laws, it can do so without following that usual process.

This law says that if someone wants to take administrative action (like a lawsuit or complaint) claiming a violation of rules under this title, they must start the process within five years from when the violation happened.