The Delete Act is a legal framework that gives consumers powerful new rights restricting the collection and use of personal information by a diverse range of data brokers.<\/p>\n\n\n\n
This framework for regulating the data broker industry was first proposed in congress in 2022, and was re-introduced in early 2023 in California, who has been leading the way in passage of new consumer data privacy law since 2018<\/a>.<\/p>\n\n\n\n The core provision of the Delete Act is that it will require all data brokers operating in California to register with the new state privacy agency, and provide a single, universal opt-out mechanism for all CA residents. <\/p>\n\n\n\n All registered companies will be required to delete and no longer track any information they have on individuals who exercise their rights via the state privacy agency. <\/p>\n\n\n\n The law will not come into effect overnight: the provisions will not begin to be enforced until July of 2026.<\/p>\n\n\n\n There is always the possibility of “death by amendment” – where between passage and enforcement, the law is eventually watered down. But we believe this is unlikely because of the strong, and still growing support<\/a> from California voters for improved data privacy protections.<\/p>\n\n\n\n Today\u2019s passage of the law in CA dramatically increases the likelihood that other states – and potentially Congress, who reintroduced<\/a> their own version in June – will quickly follow suit, and enact similar standards. This is exactly what has happened with state data privacy laws after California first passed the CCPA. <\/p>\n\n\n\n The implications for consumers, our data-driven economy, and our consumer privacy industry, are enormous. <\/p>\n\n\n\n This is a big win for consumer rights<\/strong><\/p>\n\n\n\n The passage of the Delete Act framework is a huge advance for consumer data privacy and signals continued momentum for stronger data privacy rights across the country. <\/p>\n\n\n\n Exercising data brokers opt-outs<\/a> is complex (by design), and laws like the Delete Act will require the industry to simplify and standardize processes, giving both consumers – as well as DeleteMe as a leader in Privacy as a Service – greater ability to protect personal information.<\/p>\n\n\n\n That said, individual state privacy agencies like California\u2019s will remain under-resourced when it comes to monitoring and redressing the vast range of consumer data misuse that happens daily. And its why we strongly believe that the Privacy as a Service industry will continue to play an important role in helping provide transparency and confirmation of compliance to consumers and regulators.<\/p>\n\n\n\n Data broker warnings about economic harms are mostly overblown<\/strong><\/p>\n\n\n\n The promised negative impacts<\/a> warned about by the data broker industry are – for the most part – either minor, or simply wrong. Claims of \u201cincreased risk of identity theft\u201d are the most absurd, given the industry\u2019s enablement of a vast expansion of consumer fraud<\/a> and social engineering over the last decade. The kinds of \u2018knowledge-based authentication\u2019 methods which data brokers pretend still functions as fraud-prevention have long been obsolete.<\/p>\n\n\n\n The law will <\/em>be a significant blow to the digital advertising industry, as well as a range of data-mining services they rely upon; and it will <\/em>affect some currently \u201cfree\u201d service offerings where “consumer data is the real product”; but these costs are coming after a decade of wild-west abuse of sensitive personal information, and the data broker industry is more than capable of surviving and adapting to a world where consumers have stronger controls over their personal information.<\/p>\n\n\n\n The ‘Privacy as a Service’ industry that DeleteMe pioneered is empowered by this law<\/strong><\/p>\n\n\n\n Things like Federal “Do Not Call Registry” (which is a comparable legal framework) did not end the robocalls problem for consumers. Similarly, the Delete Act will not end widespread collection and monetization of sensitive personal information. Regulations are only ever as good as their enforcement mechanisms, and the problem that state privacy agencies are taking on will ultimately require the kind of auditing and active-intervention that the Privacy as a Service industry already does every day. <\/p>\n\n\n\n