The California Delete Act was signed into law on Oct. 10, 2023. The new law will make it easier for California consumers to enact their privacy rights by introducing a one-stop-shop mechanism to request that their data be deleted by data brokers. Requirements surrounding that deletion process, as well as limitations on what data can be collected following a request, promise to have impacts on the digital marketing and advertising ecosystem.
Let’s review the new law and exactly what marketers and advertisers need to be aware of.
What is the Delete Act?
California Senate Bill 362, colloquially known as the “Delete Act,” is an update to existing law concerning data brokers in California. Existing law requires data brokers to register with the California Attorney General’s office, pay a registration fee, and provide certain information. Data brokers are then listed in a registry with their associated information. Following the passage of the Delete Act, these requirements are modified and expanded.
Beginning in 2024, data brokers will need to register with the California Privacy Protection Agency (CPPA) by submitting all required documentation and paying an administrative fee. Enforcement oversight for data broker registration and privacy obligations will then fall to the CPPA.
In addition to overseeing registration and disclosure requirements, the CPPA is also tasked with creating a centralized one-stop-shop deletion mechanism that will allow California consumers to request deletion of their personal information from all data brokers with a single, verifiable request. This system must be in place by Aug. 1, 2026. Following the introduction of the central deletion mechanism, data brokers are required to access the mechanism at least once every 45 days and process all applicable deletion requests. Data brokers are also prohibited from selling or sharing new personal information of the consumer once a request has been fulfilled.
What is a Data Broker?
A data broker is defined as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” Put simply, they are companies that collect, use, and sell personal data without a consumer’s knowledge.
The advertising ecosystem is full of data brokers that many organizations and agencies use for audience creation, audience enrichment, and targeted advertising. A quick search of the California AG’s Data Broker Registry is likely to surface at least one organization you are leveraging in digital advertising.
What is the new deletion mechanism?
California consumers are granted the right to be forgotten, or the right for their personal information to be deleted in the CCPA. The challenge today is that a consumer’s data can be obtained, shared, and sold across hundreds of entities. As of this writing (October 2023) there are over 500 registered data brokers, to say nothing of the hundreds of companies and websites a consumer directly interacts with. To be truly forgotten, a consumer would need to request for their data to be deleted from each entity, many of whom they have no idea even exist.
The new deletion mechanism makes the process of deletion far easier by introducing a centralized consumer-facing portal where deletion requests can be submitted. A single verifiable consumer request can be made for their personal information to be deleted by all data brokers, or they can select to exclude specific brokers.
The California Privacy Protection Agency has until Aug. 1, 2026 to create and publish the new deletion mechanism. While requirements have been outlined, specifics for how exactly the mechanism will operate and where it will be maintained will be defined in the coming years.
How will the Delete Act impact marketing and advertising?
According to polls, 80% of Californians surveyed would use the consumer deletion portal created by the new law. Considering California is home to over 10% of the American population, a significant proportion of consumers could have their data deleted from all data brokers. So, what kinds of activities could be impacted?
- Audience match rates
Data brokers are central to the process of identity resolution in digital advertising. Many data brokers aggregate various bits of identifying information for consumers (email, name, address, phone number, etc). Platforms can then buy and sell this data to increase the “identity surface” of an individual online. These are then used as key values to identify the same user across websites, devices, and digital platforms. Identity resolution platforms, reliant upon data brokers (with many of the top identity resolution platforms listed as data brokers themselves) would be impacted if consumers request deletion en masse.
For advertisers, this translates to lower match rates and thus less reach for their identifiable user audiences they are trying to activate across platforms and publishers. In addition to individual matching for personalized retargeting, the identification of similar consumers for lookalike audience creation is also likely to be impacted. The combination of these factors would contribute to far less targeted reach for programmatic campaigns.
- Personalized targeting
In addition to helping identify consumers across websites, applications, and devices, data brokers also supply much of the data behind targeted audience segments within the programmatic advertising space. User characteristics such as interests, gender, location, and economic status are often reliant upon user information from data brokers. Less of this data available will mean less personalized audiences available for targeting.
What can be done to mitigate the risks?
It seems cliché, but the common refrain to focus on first-party data is underscored by regulations such as the Delete Act. The abilities afforded by the new law impact third-party data and “passive” data collection. Organizations that foster strong direct relationships with their consumers and take actions based upon insights from robust first-party datasets are less likely to be impacted.
New legislation such as California’s Delete Act, promises to make it easier for consumers to express their privacy rights, such as the right to be forgotten. With fewer avenues available for the acquisition of consumer data, a sound first-party data strategy is crucial to develop the insights necessary for effective marketing and advertising in the privacy-centric future.
