California has enacted significant changes to its data broker regulations through Senate Bill 361 (SB 361), signed into law by Governor Gavin Newsom on October 8, 2025. The legislation, which takes effect January 1, 2026, substantially expands transparency and disclosure requirements for data brokers operating in the state, enhancing California’s existing privacy framework.
Under the new law, data brokers must provide more detailed information during their annual registration with the California Privacy Protection Agency (CPPA). The requirements include disclosing whether they collect specific types of consumer data such as names, dates of birth, zip codes, email addresses, phone numbers, login information, identification numbers, citizenship status, union membership, sexual orientation, gender identity, biometric data, and precise geolocation. The expanded biometric data requirements come as identity fraud rates have seen significant increases in recent years.
Data brokers that do not collect certain contact or identification information must identify one to three of the most common types of personal information they do collect. The law also requires disclosure of whether consumer data was shared or sold to foreign actors, federal or state governments, law enforcement, or developers of generative AI systems within the past year. The enhanced transparency measures address growing concerns about AI-related privacy risks and data sharing practices.
The legislation specifically defines generative AI systems as those that can generate synthetic content, including text, images, video, and audio, that emulates the characteristics of training data. It defines generative AI developers as entities that design, code, produce, or substantially modify such systems. The definition emerges as California continues to develop comprehensive AI regulations.
SB 361 builds upon California’s existing data broker regulatory framework, which already mandates registration and provides consumers with data deletion rights. The amendment is part of a broader package of privacy and AI legislation enacted in 2025, reflecting California’s ongoing development of consumer privacy protections. The state’s approach to geolocation data privacy has become particularly important following recent cases of location data misuse by major technology companies.
The CPPA will oversee compliance with the new requirements. Data brokers must update their annual registration filings to include the expanded disclosures beginning in 2026. While the law does not alter existing consumer rights regarding data deletion, it increases transparency about data broker practices, providing regulators and the public with more detailed information about how personal data is collected and shared.
Sources: WSGR Data Advisor, Inside Privacy, Mondaq
