CA SB361

Expands required registration disclosures for data brokers to the California Privacy Protection Agency, including whether they collect consumers' names, dates of birth, email addresses, phone numbers, government IDs, biometric data, citizenship/immigration status, union membership, sexual orientation, gender identity, and vehicle identification numbers

Requires data brokers to disclose whether they have shared or sold consumer data in the past year to foreign actors (defined as governments or entities from foreign adversary countries), the federal government, state governments, law enforcement, or developers of generative AI systems

Mandates that data brokers process denied deletion requests as opt-outs of the sale or sharing of personal information within 45 days of receiving the request

Prohibits the California Privacy Protection Agency from publicly displaying certain registration information on its website, including whether data brokers collect names, dates of birth, ZIP codes, email addresses, phone numbers, and mobile advertising/vehicle identification numbers

Establishes administrative fines of $200 per day for data brokers who fail to register, plus $200 per deletion request per day for failure to delete information as required