AB 883 shortens qualifying data broker deletion checks

What happened

California enacted AB 883 on September 27 as Chapter 507. The amended deletion-mechanism section requires covered brokers to access the system at least every 30 days, process requests and delete qualifying information within 30 days, and direct corresponding service-provider and contractor action. Unverifiable deletion requests become sale/sharing opt-outs under the stated limits, and recurring deletion follows the 30-day cadence. Although the amended section retains its original August 1, 2026 start language, the new amendment's ordinary effectiveness is January 1, 2027; that retained historical reference should not be treated as proof that the shortened interval governed before enactment.

Existing statutory exceptions permit specified necessary or exempt retention, restrict use of retained information, and qualify recurring deletion and later sale/sharing. Independent third-party audits begin January 1, 2028 and recur every three years, with retained materials and response to agency requests. A separate section operative July 1, 2027 requires identified public bodies to notify elected officials and judges about deletion requests and permits Attorney General, county-counsel, or city-attorney actions on their behalf, including possible punitive relief for willful violations. Those provisions do not eliminate the deletion exceptions or make every health care organization a covered broker.

Why it matters

Covered health data businesses need current deletion scheduling rather than assuming all healthcare data or businesses are exempt.

Sources

• AB883 enacted final textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-11
• California Constitution, Article IV section 8(c), official Assembly 2023–24 editionOfficial · California State Assembly · Source review 2026-10-14