Key point: California lawmakers once again increase the disclosure and transparency requirements for registered data brokers.
On October 8, 2025, California Governor Newsom signed SB 361 into law. The bill amends California’s existing data broker registration law to require data brokers to provide significantly more disclosures regarding their processing activities when annually registering with the California Privacy Protection Agency (Agency).
This amendment comes shortly after the Agency Board’s recent approval of amendments to the state’s data broker regulations to incorporate the 2023 Delete Act (SB 362), including the creation of an accessible deletion mechanism that data brokers will need to comply with starting in August 2026. Those regulations were filed with the Office of Administrative Law on September 26.
Given these developments, California data brokers will need to engage in additional compliance measures in the coming months. In the below article, we provide an overview of the changes made by SB 361.
Additional Collection Disclosure Requirements
The amendment first builds on the types of information data brokers must provide when annually registering with the Agency. Under existing law, data brokers must disclose whether they collect the personal information of minors, precise geolocation, and reproductive health care data. Data brokers will now also be required to disclose whether they collect consumers’:
- names, dates of birth, ZIP Codes, email addresses, or phone numbers;
- account login or account number in combination with any required security code, access code, or password that would permit access to a consumer’s account with a third party;
- drivers’ license number, California identification card number, tax identification number, social security number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual;
- mobile advertising identification numbers, connected television identification numbers, or vehicle identification numbers;
- citizenship data, including immigration status;
- union membership status;
- sexual orientation status;
- gender identity and gender expression data; and
- biometric data.
The amendment also contains a provision stating that if a data broker does not collect consumers’ names, dates of birth, ZIP Codes, email addresses, phone numbers, mobile advertising identification numbers, connected television identification numbers, or vehicle identification numbers, then it must disclose “up to three, but no fewer than one, of the most common types of personal information that the data broker collects.” The amendment further specifies that the information provided in connection with these disclosures will not be made publicly accessible on the Agency’s website.
New Sell / Share Disclosure Requirements
The amendment also requires data brokers to disclose whether, in the past year, they shared or sold consumers’ data to (1) a foreign actor, (2) the federal government, (3) other state governments, (4) law enforcement (unless done pursuant to a subpoena or court order), or (5) a developer of a GenAI system or model.
The amendment defines “foreign actor” as either the government of a foreign adversary country or a partnership, association, corporation, organization, or other combination of persons organized under the laws of or having its principal place of business in a foreign adversary country. “Foreign adversary country” has the same meaning as “covered nation” under 10 U.S.C. § 4872, i.e., North Korea, China, Russia, and Iran.
The amendment defines a “developer of a GenAI system” as “a business, person, partnership, corporation, or other entity that designs, codes, produces, or substantially modifies a GenAI system.” The amendment does not define what “substantially modifies” means. In turn, a “GenAI system” is defined as “an artificial intelligence that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system’s training data.”
Effective Date
The bill is set to go into effect on January 1, 2026, as it does not include a provision for a delayed effective date.
