CA SB362

Transfers data broker registration and oversight from the California Attorney General to the California Privacy Protection Agency, effective immediately for future registrations.

Requires the agency to establish an accessible deletion mechanism by January 1, 2026, allowing consumers to submit a single request to delete their personal information from all data brokers simultaneously.

Beginning August 1, 2026, data brokers must access the deletion mechanism at least every 45 days, process deletion requests within 45 days, and delete consumer data at least every 45 days thereafter while prohibiting collection of new personal information from consumers who have submitted deletion requests.

Requires data brokers to compile and disclose metrics on deletion requests received, response times, and reasons for denials by July 1 each year, and to undergo independent audits every three years starting January 1, 2028.

Establishes administrative fines of $200 per day for failure to register or comply with deletion requirements, with penalties deposited into the Data Brokers' Registry Fund to support enforcement and mechanism maintenance costs.