The California Delete Act (SB 362) is creating a major stir in the digital advertising and data analytics industries. At the center of the debate is the CPPA’s clarification of the “direct relationship” clause, which will define which businesses are considered a “data broker” and must comply with the new Delete Request and Opt-Out Platform (DROP). This article explores the nuances of this legal shift, the CPPA’s proposed changes, and the differing views of industry and privacy advocates. It’s a critical discussion that will shape the future of privacy in California and beyond.

PODCAST

Hierocode · California Delete Act (SB 362) & Delete Request Opt-Out Platform (DROP): Overview

KEY TAKEAWAYS

A central debate exists over the CPPA’s proposed changes to the “direct relationship” definition, which could expand the scope of what is considered a “data broker.”
The CPPA’s proposed definition clarifies that a business can be a data broker for indirectly collected data even if a direct relationship exists for other data.
Industry groups express concern that this interpretation goes beyond legislative intent and would create a significant compliance burden for a wider range of businesses.
Privacy advocates support the changes, arguing they are necessary to give consumers control over data collected from “unintentional interactions” like non-first-party cookies.
The Delete Act mandates the creation of the DROP by January 1, 2026, with data broker compliance starting on August 1, 2026.
The CPPA has the authority to clarify this definition through rulemaking, as the term was not explicitly defined in the original statute.
Industry standards like the IAB Tech Lab’s DDRF could provide a technical solution for DROP’s functionality.

What is the Current “Direct Relationship” Debate in California’s Delete Act?

The core debate centers on the CPPA’s proposed regulatory changes to the “direct relationship” definition, which could significantly expand the number of businesses classified as a “data broker.” A data broker is defined as a business that “knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” The CPPA’s new proposals seek to clarify this definition, but industry and privacy advocates disagree on the appropriate scope.

Evolution of the “Direct Relationship” Definition

The “direct relationship” aspect is critical because it distinguishes data brokers from businesses with whom consumers have direct engagement. The Delete Act specifically targets data collected indirectly, addressing a gap left by the California Consumer Privacy Act (CCPA), which primarily covered data collected directly from consumers.

The CPPA has proposed regulations to clarify and amend the existing definition. The CPPA now proposes to remove the three-year time limit previously associated with a direct relationship, emphasizing that a consumer must intend to interact with the business. Crucially, merely exercising CCPA rights or identity verification does not establish a “direct relationship” for the purpose of avoiding data broker registration.

A key proposed clarification states that a business is still considered a data broker concerning personal information it sells about a consumer that was not collected directly from that consumer (i.e., outside of a “first party” interaction), even if it otherwise has a direct relationship with the consumer. This aims to capture scenarios where data is acquired through “unintentional interactions,” such as third-party cookies or pixels collecting data while a consumer browses a first-party website, where the consumer did not intend to interact with that third party.

How Might a Revised Definition Impact Ad Tech and Other Industries?

The evolving definition of “direct relationship” carries significant implications for a wide range of businesses, especially those in the ad tech and analytics space that rely on third-party data.

Stakeholder Arguments: Scope Creep and Compliance Burden

Industry organizations, including the Interactive Advertising Bureau (IAB) and the Network Advertising Initiative (NAI), express significant concerns that the CPPA’s proposed definition could classify a much wider range of businesses as a “data broker.” They argue that this goes beyond the original legislative intent of SB 362, which aimed to address businesses with whom consumers are “not aware” they have a relationship. Expanding the definition to include businesses with established direct relationships, merely because some “incidental” personal information they process was collected indirectly, is viewed as an overreach that could impose considerable and unmanageable compliance burdens on small businesses.

Hypothetical Business Scenarios

Ad Networks: An ad network places a third-party cookie on a website to track user behavior and serve targeted ads. Under the proposed definition, this ad network would not have a “direct relationship” with the consumer for that specific data collection, regardless of whether the consumer has an account with the ad network’s parent company. This would classify the ad network as a data broker, requiring it to comply with DROP requests.
Analytics Firms: A web analytics company that provides insights to a website about its visitors, using data from third-party sources to enrich that data, could be considered a data broker. Even if a business uses a direct relationship with a customer for a service, its use of indirectly collected data for analytics could trigger data broker status.

Privacy Advocate Perspectives: Enhanced Consumer Control

Consumer advocacy groups, including the Electronic Frontier Foundation (EFF) and Consumer Reports, laud the Delete Act as “critical legislation to rein in the data broker industry.” They stress the importance of the CPPA’s clarification, noting that under the CCPA, consumers could not delete data originating from sources other than a direct interaction. This regulatory update, they believe, provides this missing control and ensures consumers can effectively exercise their right to delete indirectly collected data, which is at the heart of the privacy problem with data brokers.

CPPA’s Rulemaking Process and Future Outlook

The California Privacy Protection Agency operates under the Administrative Procedures Act rulemaking process to implement and enforce the CCPA and the Delete Act. The process involves publishing notices of proposed rulemaking, followed by public comment periods, with the most recent comment period closing on June 10, 2025.

CPPA’s Rationale

The CPPA asserts that the Legislature did not define “direct relationship” in the statute, thereby leaving necessary clarification to the Agency. The CPPA became aware that the types of interactions constituting a “direct relationship” were confusing for businesses, impeding compliance, and thus, regulatory clarification is necessary. The proposed definition aims to clarify that businesses collecting and selling information about consumers (but not from them) must register, regardless of any separate direct interactions.

The DROP’s Technical Aspects

The industry has been proactive in developing technical standards, such as the IAB Tech Lab’s “Adtech Data Deletion Request Framework” (DDRF). This framework provides a standardized mechanism for transmitting data deletion signals, and industry participants have encouraged the CPPA to consider its integration into the DROP to streamline compliance and leverage existing technical infrastructure. The CPPA’s proposed regulations for DROP accounts also support both manual and automated (API) access to facilitate efficiency.

CONCLUSION

The ongoing dialogue between the CPPA, industry stakeholders, and privacy advocates regarding the “direct relationship” definition underscores the complexities of balancing robust privacy protections with practical business operations. The CPPA’s efforts to clarify this term aim to give Californians an unprecedented level of control over their indirectly collected personal information, a gap that previous laws like the CCPA did not fully address. As the CPPA finalizes its regulations for the Delete Act and the forthcoming DROP, the decisions made will not only shape the future of data brokerage in California but also set critical precedents for privacy frameworks globally.

FREQUENTLY ASKED QUESTIONS (FAQ)

What is the core debate surrounding the “direct relationship” definition under California’s Delete Act?

The debate centers on whether a business with a direct consumer relationship can still be classified as a data broker if it sells personal information about that consumer that was collected indirectly (e.g., via non-first-party cookies). The CPPA’s proposed definition clarifies that this is the case.

How might the CPPA’s proposed “direct relationship” definition impact businesses?

The CPPA’s proposed definition could significantly broaden the scope of businesses classified as data brokers, including those in ad tech and analytics. This could lead to increased compliance burdens and the potential for unintended deletion of first-party data.

Are non-first-party cookies affected by the “direct relationship” definition?

Yes. The CPPA clarifies that a business does not have a direct relationship with a consumer for personal information collected via “unintentional interactions” like non-first-party cookies. This means the third party collecting via such cookies could be considered a data broker.

What is the CPPA’s rationale for its proposed changes to the definition?

The CPPA states that the statutory definition in SB 362 was unclear, impeding compliance. The proposed changes aim to clarify the definition to ensure that consumers can effectively exercise their right to delete indirectly collected data, a right not fully covered by the CCPA.

What happens if a data broker cannot verify a deletion request submitted via the DROP?

If a data broker cannot verify a consumer’s deletion request made through the DROP, the law requires them to process that request as an opt-out of the sale or sharing of the consumer’s personal information. They must also direct their service providers and contractors to do the same.

Are there any exceptions to the data deletion requirements for data brokers?

Yes, data brokers are not required to delete a consumer’s personal information if it’s necessary to maintain the information for specific, legally defined purposes, or if the deletion is not required pursuant to Civil Code sections 1798.145 or 1798.146. Exemptions also apply to entities covered by certain federal laws like FCRA or GLBA.

How frequently must data brokers interact with the DROP?

Beginning August 1, 2026, data brokers are required to access the DROP at least once every 45 calendar days to download and process new or amended deletion requests.

What are the financial implications for data brokers under the Delete Act?

Data brokers are required to pay an annual registration fee and may be charged an access fee for using the DROP to cover its operational costs. Failure to comply can result in administrative fines and other costs.

What is the role of the IAB Tech Lab’s Data Deletion Request Framework in this context?

The IAB Tech Lab’s DDRF is an industry-developed technical standard for transmitting data deletion signals. Industry participants have suggested this framework could serve as the protocol for communicating deletion requests under California’s SB 362, potentially streamlining integration with the CPPA’s DROP.

What is a “data broker” under California law?

A data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.

View Related Articles

Foundational Overview

California Delete Act (SB 362) & DROP Platform: Overview

Core Concepts

Data Broker Compliance & Operations

Governance, Architecture & Impact

REFERENCES

View References

[California Privacy Protection Agency, Laws & Regulations.](https://cppa.ca.gov/regulations/)
[California Privacy Protection Agency, California Consumer Privacy Act, CCPA – last updated 12/2024.](https://cppa.ca.gov/regulations/pdf/ccpa_statute.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act, CCPA Updated Monetary Thresholds – effective 01/2025](https://cppa.ca.gov/regulations/cpi_adjustment.html)
[California Privacy Protection Agency, California Consumer Privacy Act, Proposition 24 – Text, includes Findings and Declarations, Purpose and Intent](https://cppa.ca.gov/regulations/pdf/prop24_text.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act, Proposition 24 – Voter Guide](https://cppa.ca.gov/regulations/pdf/prop24_sos.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act, California Consumer Privacy Act Regulations](https://cppa.ca.gov/regulations/pdf/cppa_regs.pdf)
[California Privacy Protection Agency, Proposed Regulations, Delete Request and Opt–out Platform (“DROP”) System Requirements – Public Comment Period open from April 25, 2025 – June 10, 2025](https://cppa.ca.gov/regulations/drop.html)
[California Privacy Protection Agency, Completed Regulation Packages, Data Broker Registration Fee Regulation (December 2024)](https://cppa.ca.gov/regulations/data_broker_regulations.html)
[California Privacy Protection Agency, Completed Regulation Packages, Data Broker Registration Regulations (December 2024)](https://cppa.ca.gov/regulations/data_broker_registration_regs.html)
[California Privacy Protection Agency, Completed Regulation Packages, Data Broker Registration Fee Regulation (January 2024)](https://cppa.ca.gov/regulations/data_broker_regulations.html)
[California Privacy Protection Agency, California Privacy Protection Agency, Completed Regulation Packages, California Consumer Privacy Act Regulations (March 2023)](https://cppa.ca.gov/regulations/consumer_privacy_act.html)
[California Privacy Protection Agency, California Privacy Protection Agency, Completed Regulation Packages, Transfer of Rulemaking Authority & New Division for CPPA Regulations (April 2022)](https://cppa.ca.gov/regulations/transfer_rulemaking_authority.html)
[California Privacy Protection Agency, California Privacy Protection Agency, Completed Regulation Packages, Conflict of Interest Code Regulation (February 2022)](https://cppa.ca.gov/regulations/conflict_of_interest_code_reg.html)
[California Privacy Protection Agency, Tips for Submitting Public Comment](https://cppa.ca.gov/regulations/pdf/comments_tips.pdf)
[California Privacy Protection Agency, Delete Act – Data Broker Registration & Accessible Delete Mechanism, Delete Act](https://cppa.ca.gov/regulations/pdf/data_broker_reg_delete_act_statute.pdf)
[California Privacy Protection Agency, Delete Act – Data Broker Registration & Accessible Delete Mechanism, Data Broker Registration Regulations](https://cppa.ca.gov/regulations/pdf/data_broker_reg_fee.pdf)
[California Privacy Protection Agency, Proposed Regulations on Accessible Delete Mechanism – Delete Request and Opt–out Platform (“DROP”) System Requirements, Rulemaking Documents, Notice of Proposed Rulemaking](https://cppa.ca.gov/regulations/pdf/ccpa_updates_accessible_deletion_mechanism_notice.pdf)
[California Privacy Protection Agency, Proposed Regulations on Accessible Delete Mechanism – Delete Request and Opt–out Platform (“DROP”) System Requirements, Rulemaking Documents, Text of Proposed Regulation](https://cppa.ca.gov/regulations/pdf/ccpa_updates_accessible_deletion_mechanism_text.pdf)
[California Privacy Protection Agency, Proposed Regulations on Accessible Delete Mechanism – Delete Request and Opt–out Platform (“DROP”) System Requirements, Rulemaking Documents, Initial Statement of Reasons](https://cppa.ca.gov/regulations/pdf/ccpa_updates_accessible_deletion_mechanism_isor.pdf)
[California Privacy Protection Agency, Proposed Regulations on Accessible Delete Mechanism – Delete Request and Opt–out Platform (“DROP”) System Requirements, Rulemaking Documents, Economic and Fiscal Impact Statement (STD 399)](https://cppa.ca.gov/regulations/pdf/ccpa_updates_accessible_deletion_mechanism_std_399.pdf)
[California Privacy Protection Agency, Proposed Regulations on Accessible Delete Mechanism – Delete Request and Opt–out Platform (“DROP”) System Requirements, Preliminary Public Comments, Public Hearing – June 26, 2024](https://cppa.ca.gov/meetings/materials/20240626_transcript.pdf)
[California Privacy Protection Agency, Proposed Regulations on Accessible Delete Mechanism – Delete Request and Opt–out Platform (“DROP”) System Requirements, Preliminary Public Comments, Public Hearing – June 10, 2025](https://youtu.be/GOaxLY_4FDk)
[California Privacy Protection Agency, Data Broker Registration Fee (2025 Registration), Notice of File and Print](https://cppa.ca.gov/regulations/pdf/20241227_dbfee_oal.pdf)
[California Privacy Protection Agency, Data Broker Registration Fee (2025 Registration), Final Regulation Text](https://cppa.ca.gov/regulations/pdf/20241227_dbfee_finaltext.pdf)
[California Privacy Protection Agency, Data Broker Registration Fee (2025 Registration), Explanatory Statement](https://cppa.ca.gov/regulations/pdf/20241227_dbfee_oalfinal.pdf)
[California Privacy Protection Agency, Transferring the Registration Fee to Agency (2024 Registration), Notice of File and Print](https://cppa.ca.gov/regulations/pdf/data_broker_registry_fee_notice_of_approval.pdf)
[California Privacy Protection Agency, Transferring the Registration Fee to Agency (2024 Registration), Final Regulation Text](https://cppa.ca.gov/regulations/pdf/data_broker_registry_fee_final_regulations_text.pdf)
[California Privacy Protection Agency, Transferring the Registration Fee to Agency (2024 Registration), Explanatory Statement](https://cppa.ca.gov/regulations/pdf/data_broker_registry_fee_explanatory_statement.pdf)
[California Privacy Protection Agency, Data Broker Registration Regulations, December 26, 2024 – Final Rulemaking Documents, Notice of Approval](https://cppa.ca.gov/regulations/pdf/20241226_dbr_notice.pdf)
[California Privacy Protection Agency, Data Broker Registration Regulations, December 26, 2024 – Final Rulemaking Documents, Approved Regulations Text](https://cppa.ca.gov/regulations/pdf/20241226_dbr_final.pdf)
[California Privacy Protection Agency, Data Broker Registration Regulations, December 26, 2024 – Final Rulemaking Documents, Final Statement of Reasons](https://cppa.ca.gov/regulations/pdf/20241224_dbr_fsor.pdf)
[California Privacy Protection Agency, Data Broker Registration Regulations, December 26, 2024 – Final Rulemaking Documents, Addendum to Final Statement of Reasons](https://cppa.ca.gov/regulations/pdf/20241224_dbr_fsoraddm.pdf)
[California Privacy Protection Agency, Data Broker Registration Regulations, Public Comments, Comments received during the 45-day public comment period – Data Broker Registration Regulations](https://cppa.ca.gov/regulations/pdf/data_broker_reg_comments.pdf)
[California Privacy Protection Agency, Data Broker Registration Regulations, July 5, 2024 – Public Notice of Rulemaking and Related Documents, Notice of Proposed Rulemaking](https://cppa.ca.gov/regulations/pdf/data_broker_reg_nopa.pdf)
[California Privacy Protection Agency, Data Broker Registration Regulations, July 5, 2024 – Public Notice of Rulemaking and Related Documents, Text of Proposed Regulation](https://cppa.ca.gov/regulations/pdf/data_broker_reg_prop_text.pdf)
[California Privacy Protection Agency, Data Broker Registration Regulations, July 5, 2024 – Public Notice of Rulemaking and Related Documents, Initial Statement of Reasons](https://cppa.ca.gov/regulations/pdf/data_broker_reg_isor.pdf)
[California Privacy Protection Agency, Data Broker Registration Regulations, July 5, 2024 – Public Notice of Rulemaking and Related Documents, Economic and Fiscal Impact Statement (STD 399)](https://cppa.ca.gov/regulations/pdf/data_broker_reg_std399.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Final Regulations Text](https://cppa.ca.gov/regulations/pdf/20230329_final_regs_text.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Final Statement of Reasons](https://cppa.ca.gov/regulations/pdf/20230329_final_sor.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Final Statement of Reasons Addendum](https://cppa.ca.gov/regulations/pdf/20230329_final_sor_addendum.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Final Statement of Reasons – Appendix A (45-Day Comment Summaries and Responses)](https://cppa.ca.gov/regulations/pdf/20230329_final_sor_app_a_comments.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Final Statement of Reasons – Appendix B (45-Day Commenter Index)](https://cppa.ca.gov/regulations/pdf/20230329_final_sor_app_b_commenter.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Final Statement of Reasons – Appendix C (15-Day Comment Summaries and Responses)](https://cppa.ca.gov/regulations/pdf/20230329_final_sor_app_c_comments.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Final Statement of Reasons – Appendix D (15-Day Commenter Index)](https://cppa.ca.gov/regulations/pdf/20230329_final_sor_app_d_commenter.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), ](https://cppa.ca.gov/regulations/pdf/20230329_final_sor_app_d_commenter.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Final Economic and Fiscal Impact Statement (STD 399)](https://cppa.ca.gov/regulations/pdf/20230329_final_std_399.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Final STD 399 Addendum](https://cppa.ca.gov/regulations/pdf/20230329_final_std_399_addendum.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Notice of Approval](https://cppa.ca.gov/regulations/pdf/20230329_notice_of_approval.pdf)
[California Privacy Protection Agency, California Consumer Privacy Act Regulations (March 2023), Updated Informative Digest](https://cppa.ca.gov/regulations/pdf/20230329_upd_info_digest.pdf)
[California Privacy Protection Agency, Transfer of Rulemaking Authority, Notice to the Attorney General Regarding Rulemaking Authority Under the CCPA](https://cppa.ca.gov/regulations/pdf/20211021_notice_to_ag.pdf)
[California Privacy Protection Agency, Transfer of Rulemaking Authority, 2022-0325-02NR Approval – Notice of Approval of Changes Without Regulatory Effect](https://cppa.ca.gov/regulations/pdf/2022032_02nr_approval.pdf)
[California Privacy Protection Agency, Transfer of Rulemaking Authority, CCPA (Section 100) – Explanatory Statement](https://cppa.ca.gov/regulations/pdf/sec100_explanatory_statement.pdf)
[California Privacy Protection Agency, Conflict of Interest Code Regulation (February 2022), Final Text and Approval](https://cppa.ca.gov/regulations/pdf/coi_fta.pdf)
[California Privacy Protection Agency, Conflict of Interest Code Regulation (February 2022), Notice of Intent to Adopt](https://cppa.ca.gov/regulations/pdf/coi_noia.pdf)
[California Privacy Protection Agency, Information for Data Brokers](https://cppa.ca.gov/data_brokers/)
[California Privacy Protection Agency, Data Broker Registration statute](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB362)
[California Privacy Protection Agency, Civ. Code § 1798.99.82(d)](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB362)
[California Privacy Protection Agency, Data Broker Registry](https://cppa.ca.gov/data_broker_registry/)
[Office of the Attorney General, Data Broker Registry](https://oag.ca.gov/data-brokers)
[California Privacy Protection Agency, Data Broker Registry, Incomplete 2023 Registrations](https://oag.ca.gov/data-brokers/incomplete/2023)
[California Privacy Protection Agency, Data Broker Registry, Incomplete 2022 Registrations](https://oag.ca.gov/data-brokers/incomplete/2022)
[California Privacy Protection Agency, Data Broker Registry, Incomplete 2021 Registrations](https://oag.ca.gov/data-brokers/incomplete/2021)
[IAB Tech Lab, Data Deletion Request Framework](https://iabtechlab.com/standards/data-deletion-request-framework/)
[IAB Tech Lab, Global Privacy Protocol Specification](https://iabtechlab.com/gpp/)

Tagged:Compliance

AceNetwork Engineer

Ace is a network engineer with a focus on cybersecurity and data privacy. His work in California centers on the architectural development of secure, resilient, and high-performance digital networks. Known for a methodical and forward-thinking approach, Ace's expertise lies in fortifying enterprise infrastructure against modern cyber threats. He is a leading advocate for the implementation of robust security protocols and the establishment of privacy-centric network architectures. His professional insights are informed by a commitment to continuous research into emerging technologies and evolving digital vulnerabilities.

The ‘Direct Relationship’ Definition Debate: CA Data Brokers

Table of Contents

The ‘Direct Relationship’ & ‘Data Broker’ Definition Debate: Scope, Evolution & Impact

INTRODUCTION