AB 883 shortens qualifying data broker deletion checks
Oct 4, 2026 edition · GC-2026-0253 · Published 2026-10-04 · Version 2 · Final
AB 883 reduces qualifying data brokers’ deletion-mechanism access and processing periods to 30 days and tightens recurring deletion. A separate notice and civil-enforcement framework for elected officials and judges becomes operative July 1, 2027, with existing deletion exceptions retained.
What happened
California enacted AB 883 on September 27, amending Civil Code section 1798.99.86 to replace specified 45-day deletion-mechanism periods with 30 days. The chaptered text requires a data broker to access the mechanism at least once every 30 days, process qualifying deletion requests and delete covered information within 30 days, and treat unverifiable requests as sale-or-sharing opt-outs within that period. It also requires directions to associated service providers and contractors. Following a deletion, recurring deletion is at least every 30 days unless the consumer requests otherwise or an exception applies, and new information generally cannot be sold or shared without the consumer’s request or a statutory basis. The enactment is the event reported here; the applicable commencement of these provisions must be confirmed separately.
The section retains exceptions for information reasonably necessary for the listed CCPA purposes or exempt under the cited provisions; retained information is restricted to those purposes, including a ban on repurposing it for marketing. New section 1798.99.86.5 assigns specified public bodies notice duties so elected officials and judges can use the mechanism and authorizes the Attorney General, county counsel or a city attorney to seek civil relief on their behalf. A willful violation can support punitive damages. That separate section becomes operative July 1, 2027. Its date should not be substituted for the distinct broker-interval amendment or the older dates retained in section 1798.99.86.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
Why it matters
Covered data businesses need recurring scheduling and downstream cooperation, not only a one-time deletion event. Healthcare activity does not by itself answer whether a business or a particular dataset is within the broker law or a cited exception. Separate commencement rules need to remain visible when implementation dates are assigned.
Recommended action
Confirm the applicable commencement before treating the new provisions as current duties. Prepare the following for implementation at that commencement: Confirm broker and data applicability and prepare the 30-day access, processing and recurring-deletion controls. Document any retention exception and restrict further use to its permitted purpose. Track the July 1, 2027 public-official framework separately and preserve evidence that requests and downstream instructions were processed.
Sources
- AB883 enacted final textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-05
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →