California Will Require Data Brokers to Honor New Opt-out Privacy Requirements

In early October, California enacted an amendment to its existing privacy laws that will allow Golden State consumers to submit a global opt-out directive to stop data brokers from collecting and processing information about them.  Currently, the laws in California require that consumers register separately with each data broker in order to control their information. The new law will also provide a uniform timeframe for data brokers to respond to consumer data access requests, and it moves enforcement from the state's DOJ to its newly created privacy regulator (CPPA).  

Why It Matters

California continues to set the bar high for privacy compliance in the US.  While most companies will not be subject to this law, it does have some troubling ambiguity in it. “Data brokers” are defined as companies that “knowingly collect and sell” consumer personal information in the absence of a “direct relationship” with the consumer.  

The term “direct relationship” is not defined, and could give rise to questions about whether certain service providers or contractors (i.e., a behind-the-scenes supplier) may be counted as “data brokers” depending on how the CPPA handles enforcement. Companies that “sell” consumer information but are not consumer-facing may wish to seek advice on whether they could inadvertently be classified as “data brokers” under a broad reading of the law.