Privacy & Cybersecurity Law Blog

On September 27, 2026, California Governor Newsom approved AB 883 (“the Act”), which tightens the state’s existing data broker legislation. First, the Act shortens the timeline for processing requests made through California’s Delete Request and Opt-Out Platform (“DROP”). Data brokers will now be required to access DROP and process requests every 30 days (previously 45 days) and process requests within 30 days of accessing the portal (again previously 45 days).

Beginning on July 1, 2027, the Act also requires the California Secretary of State, local filing officers, the Judicial Council, and the State Bar of California to notify state and local elected officials and judges of their ability to submit a request to delete their personal information through DROP. The Act provides that the Attorney General, a county counsel, or city attorney may bring a civil action on behalf of a judge or elected official if a data broker fails to comply with its requirements under the data broker law with respect to personal information about the judge or elected official, and notably, a court can award punitive damages for willful violations.