California Data Broker Rules Tighten: Miller, Sperling and Montoya Publish Bloomberg Law Guidance on SB-361 Compliance

Glaser Weil litigation partners Sarah G. Miller and Elizabeth Sperling, together with litigation associate Joseph N. Montoya, have published a timely new article, “California Data Brokers Must Build a New Compliance Playbook,” for Bloomberg Law examining California's rapidly expanding regulation of data brokers and the significant compliance obligations businesses will soon face under SB-361.

As part of California's evolving privacy framework, SB-361 expands the state's Delete Act and will require registered data brokers to regularly monitor the California Privacy Protection Agency's Data Broker Requests and Opt-Out Platform (DROP) for consumer deletion requests. With new compliance requirements taking effect August 1, 2026, and daily penalties for violations, companies that collect, buy, sell or share Californians' personal information should carefully evaluate whether they qualify as data brokers and establish robust compliance procedures now.

Miller, Sperling and Montoya explore several key issues businesses must consider, including:

• Who qualifies as a data broker under California law, including businesses that may not realize they fall within the statute's broad definition
• How personal information is defined and why companies outside California may still be subject to enforcement actions
• The distinction between direct and indirect consumer relationships, and why businesses using third-party tracking technologies may face heightened scrutiny
• New registration and reporting requirements that require detailed disclosures to the California Privacy Protection Agency
• The upcoming DROP monitoring requirement, which will require data brokers to review deletion requests at least every 45 days and promptly delete covered information
• The substantial penalties for noncompliance, including daily fines tied to registration failures and unmet deletion requests
• Practical compliance strategies for assessing data practices, updating vendor-management procedures and maintaining records of consumer deletion requests

Read the article to learn how businesses can determine whether they are data brokers, prepare for California's new deletion-request requirements and reduce regulatory risk as enforcement by the California Privacy Protection Agency intensifies.