AB 302: Data brokers: elected officials and judges.

Session Year: 2025-2026
House: Assembly

Current Status:

In Progress

(2025-08-29: In committee: Held under submission.)

Introduced

First Committee Review

First Chamber

Second Committee Review

Second Chamber

Enacted

Version:

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business delete any personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

The Information Practices Act of 1977 regulates the use of personal information by certain state agencies, including by requiring a state agency to maintain in its records only personal information that is relevant and necessary to accomplish a purpose of the agency required or authorized by the California Constitution or statute or mandated by the federal government.This bill would authorize a protected individual, or the agency on behalf of a protected individual, to request a business, as defined, to refrain from selling the protected individuals personal information, as defined, or to delete the protected individuals personal information, as specified. The bill would also authorize a protected individual, or the protected individuals authorized representative, to request a governmental entity, defined, in part, to mean a local agency, to refrain from publishing the protected individuals personal information or to remove the protected individuals personal information from any existing publication, as prescribed. Upon receipt of the request, the bill would require a governmental entity to take prescribed action, including taking steps reasonably necessary to ensure that the personal information is not published. By imposing additional duties on local agencies, the bill would impose a state-mandated local program. The bill would authorize a protected individual and certain public attorneys, including the Attorney General, to punish noncompliance with those provisions with a certain civil action.

Existing law requires the agency to establish an accessible deletion mechanism that, among other things, allows a consumer to request the deletion of all personal information related to that consumer through a single deletion request. Existing law requires, beginning August 1, 2026, a data broker to access the accessible deletion mechanism at least once every 45 days and, within 45 days after receiving a request, process all deletion requests and delete all personal information related to the consumers making the requests, as prescribed. Existing law requires a data broker to delete all personal information of the consumer at least once every 45 days unless the consumer requests otherwise, as prescribed. Existing law defines data broker to mean a business, as defined, that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, except as provided.

This bill would require the agency to obtain a list of all state and local elected officials that includes their contact information and officials, would require the Judicial Council to provide the agency with a list of all California judges that includes their contact information, judges, and would require the agency to allow elected officials or a judges to remove their information from those lists, as prescribed. The bill would require the lists to be kept confidential, as specified. The bill would also require the agency to upload the lists to the accessible deletion mechanism described above and, beginning August 1, 2026, require an entity receiving a notification that a deletion is required to do so within 5 days.

This bill would also prohibit a business from knowingly selling the personal information of a protected individual if the business knows, or reasonably should know, that selling the personal information poses an imminent and serious threat to the protected individual and certain harms result from the selling of the personal information. The bill would make a person who violates this provision liable for a civil penalty, as specified. authorize an elected official or judge who is on a list described above, the Attorney General, a county counsel, or a city attorney to bring an action for a violation of the bill, as prescribed.

This bill would define various terms for its purposes, including by defining protected individual to mean a current or former representative elected in the state, as determined by the Secretary of State, an appointed officer of a court or a magistrate in the state, or a spouse, a child, or a dependent who resides in the same household as those individuals.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

Discussed in Hearing