Written by: Haim Ravia, Dotan Hammer
On October 8, 2025, Governor Gavin Newsom signed into law a bill amending California’s data broker registration law with new disclosure requirements for data brokers. The Governor describes the bill as part of a broader agenda that focuses on consumer protection and provides consumers greater control over their data. The amendment will take effect on January 1, 2026.
The key changes introduced by the new amendment focus on:
- Expanded Disclosures. A data broker’s annual registration with the California Privacy Protection Agency (CPPA) must now report whether it collects sensitive data such as biometric information, immigration status, gender identity, union membership, and other identifiers (e.g., email, phone numbers, account logins, VINs).
- Data Sharing Transparency. A data broker’s registration must also disclose if it has shared or sold data in the past year to the following:
- Foreign entities
- S. federal or state governments
- Law enforcement (unless via subpoena or court order)
- Developers of generative AI models
- Deletion Requests. Data brokers have 45 days to treat unverifiable deletion requests as opt-outs of sale or sharing under the California Consumer Privacy Act.
- Public Registry Updates. The CPPA will list newly required data types and third-party disclosures on its public data broker registry, though some limits apply to non-sensitive data.
Click here to read the amendment to California’s data broker law.
