EPIC, Coalition Urge California to Make Data Broker Deletion Mechanism Painless for Consumers

EPIC joined comments to the California Privacy Protection Agency this week concerning the agency’s implementation of SB 362—also known as the Delete Act—alongside Consumer Reports, the Electronic Frontier Foundation, and Privacy Rights Clearinghouse. The Delete Act requires the CPPA to create a central mechanism for Californians to demand that their personal information be deleted from all data brokers registered in the state. This law reflects consumers’ general preference to not be tracked online and is a critical step towards reining in the largely unregulated data broker industry. The joint comments urged the Agency to establish a deletion mechanism that uses an email address or phone number to verify a consumer without other unnecessary information; ensures that data brokers delete all corresponding information reasonably linked with the verified consumer; and incorporates data minimization requirements and purpose limitations that apply when data brokers process consumer requests. The CPPA has previously issued guidance for companies to apply data minimization principles to consumer requests, such as the request to opt out of the sale of personal information or during the verification of a consumer’s identity during a request. EPIC regularly provides comments to the CPPA and published detailed analysis of the California Privacy Rights Act. EPIC provided extensive input on proposed CPPA rules in November 2021, May 2022, August 2022, and November 2022.