Securities Attorney for Going Public Transactions

Securities Lawyer Blog

knowledge itself is power

CPPA Releases Data Broker Regulations

On July 5, 2024, the California Privacy Protection Agency (CPPA) released proposed regulations to implement the DELETE Act, a significant piece of legislation affecting businesses classified as "data brokers." The DELETE Act mandates that these businesses register with the CPPA and provide specific disclosures, both to the agency and on their websites. The CPPA’s recent notice of proposed rulemaking aims to clarify some of the act’s requirements, addressing common questions and potential obstacles for businesses.

### Key Highlights of the Proposed Regulations

#### 1. **Clarification of "Direct Relationship"**

The DELETE Act targets businesses that collect and sell personal information of consumers without a direct relationship. The proposed regulations define a "direct relationship" as one where a consumer has intentionally interacted with a business to obtain information, access, purchase, or use the business's products or services within the last three years. Importantly, a business is still considered a data broker if it sells personal information not directly collected from the consumer, even if it has a direct relationship with them. This definition helps clarify which businesses are covered by the act, making it easier for companies to determine their obligations.

#### 2. **New Definitions of "Minor" and "Reproductive Health Care Data"**

The CPPA has provided new definitions to clarify key aspects of the DELETE Act:

- **Minor**: A "minor" is defined as a consumer that the data broker knows is under 16 years old.

- **Reproductive Health Care Data**: This broad definition includes any information related to goods or services associated with the human reproductive system, sexual history, and family planning. It covers everything from contraception and menstrual-tracking apps to inferences made about a consumer’s reproductive health.

These definitions are critical for businesses to understand as they must disclose whether they collect such data.

#### 3. **Parent and Subsidiary Registration Requirements**

The proposed regulations also address the registration requirements for parent and subsidiary businesses. If a business meets the definition of a data broker, it must register with the CPPA, regardless of whether it is a parent or subsidiary of another business. This means that even if a parent company is registered as a data broker, its subsidiary, if also a data broker, must register separately. Conversely, if a business is a data broker, its parent or subsidiary that does not qualify as a data broker would not need to register.

### What’s Not Addressed

Interestingly, the proposed regulations do not tackle the CPPA's obligation to establish an "accessible deletion mechanism" by January 1, 2026, which would allow consumers to request that all registered data brokers delete their personal information through a single verifiable consumer request. This omission leaves some uncertainty about how the DELETE Act will be fully implemented in the future.

### What Businesses Should Do Next

Businesses that may fall under the definition of a data broker should start preparing for these new regulations. This preparation includes:

- Evaluating whether their relationships with consumers meet the "direct relationship" definition.

- Reviewing their data collection practices to determine if they involve minors or reproductive health care data.

- Ensuring that both parent and subsidiary entities that qualify as data brokers are ready to comply with the registration requirements.

### Conclusion

The proposed regulations under the DELETE Act are a crucial development for data brokers operating in California. By providing clarity on definitions and registration requirements, the CPPA is helping businesses understand their compliance obligations. However, with certain aspects of the DELETE Act’s implementation still pending, businesses must stay vigilant and ready to adapt to future regulatory changes.

If your business may be impacted by these regulations, it is advisable to consult with a legal professional specializing in privacy law to ensure compliance and mitigate any risks associated with the CPPA's forthcoming rules.

Gayatri Gupta