Earlier quoted context omitted.
From the bill: > The bill would, beginning January 1, 2028, and every 3 years thereafter, require a data broker to undergo an audit by an independent third party to determine compliance with these provisions and would require the data broker to submit an audit report to the agency upon the agency’s written request, as specified. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
I don't think that section answers the question.
> "This bill would require the agency to establish, by January 1, 2026, an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor. The bill would specify requirements for this accessible deletion mechanism, and would, beginning August 1, 2026, require a data broker to access the mechanism at least once every 45 days and, among other things, process all deletion requests, except as specified. Beginning July August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to the bill’s provisions, the bill would require the data broker to delete all personal information of the consumer at least once every 45 days, as specified, and would prohibit the data broker from selling or sharing new personal information of the consumer, as specified....
> "This bill would provide that a data broker that fails to comply with the requirements pertaining to the accessible deletion mechanism described above is liable for civil penalties, administrative fines, fees, and costs, as specified, and would raise the amount of the existing civil penalty provisions described above...."
I guess it all comes down to the implementation level how specific and "actually deleting" they will be. And whether the new agency (ugh) charged with enforcing this will actually have teeth in the details.
And I don't know why such a long 45 day period is required. For reasons we're all too familiar with, people are quite able to gather data within seconds, but somehow need 45 days to delete it?