California Shortens Data Broker Processing Deadlines

A new law requires brokers to process deletion requests within 30 days starting in 2027.

Updated on Oct. 21, 2026 in Cybersecurity

California Shortens Data Broker Processing Deadlines

Live Poll

Should data brokers be held to stricter state-mandated timelines for processing personal data removal requests?

On September 27, 2026, California Governor Gavin Newsom signed AB 883, which accelerates the processing requirements for data brokers operating in the state. The legislation mandates that brokers check the Delete Request and Opt-Out Platform every 30 days to address privacy requests.

Why it matters

The Act shortens the response window for data brokers, tightening privacy protections for public officials who may be subject to targeted data harvesting. By mandating more frequent platform access, the state aims to reduce the persistence of sensitive personal information in broker databases.

Data brokers must now interface with the state's Delete Request and Opt-Out Platform on a 30-day cycle, a 33% reduction in the grace period from the prior 45-day standard. Compliance failures trigger potential civil actions from the Attorney General or local counsel, with the possibility of courts awarding punitive damages for willful violations.

The players

Gavin Newsom

The Governor of California who approved the legislation to amend state data broker oversight.

The details

The Delete Request and Opt-Out Platform serves as a centralized portal for managing data removal requests. Under AB 883, brokers are obligated to access this portal at least once every 30 days to retrieve new requests and must verify the removal of data within 30 days of that access. Additionally, the Act compels specific government agencies to proactively notify judges and elected officials of their legal right to request the deletion of their personal information from these platforms.

September 27, 2026: Governor Newsom signed AB 883 into law.
July 1, 2027: Notification requirements for elected officials and judges take effect.

The Tech Race

This legislation updates the operational requirements established under the California Consumer Privacy Act. It marks a shift toward more aggressive state-level enforcement of data deletion protocols compared to earlier industry-standard timelines.

Elected officials and judges will receive formal notifications regarding their data privacy rights starting in mid-2027. These individuals can then leverage the expedited 30-day processing window to ensure their personal information is removed from broker databases.

The takeaway

The move forces data brokers to maintain tighter synchronization with state-run privacy portals. Readers should track the implementation of the July 1, 2027 notification requirements to see how effectively the state manages the expanded scope for public officials.