California Governor signed into law the Data Broker Transparency and Control Act, creating the nation's most stringent regulations for companies that buy, sell, and trade consumer personal information. The law requires all data brokers operating in California to register with the state and participate in a centralized opt-out portal launching January 2027.
Under the new law, consumers can submit a single opt-out request through the state-managed portal that will be propagated to all registered data brokers within 30 days. Data brokers who fail to honor opt-out requests face fines of up to $200 per consumer per day of noncompliance, with enforcement handled by the California Privacy Protection Agency.
Privacy advocates have hailed the legislation as a model for other states, noting that the current system requires consumers to submit individual opt-out requests to hundreds of data brokers separately. Industry groups have pushed back, arguing that the compliance costs will be disproportionately burdensome for smaller data analytics firms.
