An author and entrepreneur is supporting efforts in three states to export a consumer data privacy bill he helped get across the finish line in his home state of California.
Tom Kemp worked with Sen. Josh Becker (D) to develop California’s Delete Act in 2023. This year he’s provided counsel and watched as lawmakers in Illinois, Nebraska and Vermont have introduced similar bills that would make it easier for consumers to request that third-party data brokers delete their personal information.
“People come to me, I provide advice,” Kemp said in an interview.
The Delete Act requires states to establish a one-stop portal where consumers can go to make a single request to all data brokers to dump their brokered personal information. The concept has been compared to the do-not-call registry for telemarketers. Data brokers must honor the requests and continue to delete newly acquired data every 45 days, or until the consumer rescinds the request.
The law also requires data brokers to provide notice of data breaches, disclose the type of sensitive data they collect from consumers, and certify that the data will only be used for legitimate purposes.
Data brokers are defined as companies that collect or sell consumer personal data without having a direct relationship with them.
“We are all at the mercy of data brokers,” said Rep. Monique Priestley (D), sponsor of the Vermont bill. “The Delete Act changes that … putting [consumers] in charge of their digital lives.”
Kemp, who also helped get California’s Privacy Rights Act passed in 2020, said he offered input to Priestley and to Nebraska Sen. Margo Juarez about their Delete Act bills. He also recently spoke with Illinois Rep. Daniel Didech (D) regarding his bill.
By Kemp’s estimate, data brokering is a $250 billion to $300 billion a year industry spanning 4,000 companies that build digital dossiers on consumers that can then be sold to advertisers.
Kemp, who wrote a book titled, “Containing Big Tech: How to Protect our Civil Rights, Economy, and Democracy,” said tech industry lobbyists can “flood the zone” in statehouses. He views the Delete Act as a targeted policy that can defeat that resistance.
“It’s the power of the idea,” Kemp said. “I don’t want this to be David and Goliath, but I have an important stone that I can throw, which is addressing the privacy concerns emanating from the data broker industry.”
Kemp said the Delete Act sits atop two other data broker regulations that states can consider.
The first is a basic requirement that data brokers register with the state, something that is already in place in California, Oregon, Texas and Vermont. The second is a Texas-style mandate that data brokers adopt a data security program and a credentialing program so they don’t sell to fraudsters.
Lawmakers in Maryland and Washington State took a different approach this year. They proposed to require data brokers to register with the state as part of a plan to tax the industry. The Washington bill did not advance; the Maryland proposal got a hearing last week.
Kemp said the Delete Act concept appeals to lawmakers in both red states and blue states because of issues such as data breaches, elder fraud and scams, which can be enabled by unscrupulous data purchasers.
But it was the Supreme Court’s overturning of Roe v. Wade in 2022 that Kemp said provided urgency to California lawmakers to pass the Delete Act the following year. Privacy and reproductive rights advocates warned that data brokers could sell information about women who are pregnant or visiting abortion clinics.
Kemp said that shifted the perception from an annoyance to, “Wait a minute, now they can track me going to an abortion clinic.”
Virginia lawmakers considered a bill this year to ban the sale of geolocation data. Similar measures have been introduced in California and Massachusetts.
Kemp is also working with Becker, author of California’s Delete Act, on a bill to require data brokers to report when they collect information about people’s citizenship status, union membership, sexual orientations or biometric data.
But getting the Delete Act passed in more states remains Kemp’s priority. He said he tries to provide lawmakers with a “turnkey” legislative kit to help them get the bill introduced and passed.
Other Delete Act supporters include the Center for Democracy & Technology, Center for Digital Democracy, Consumer Federation of America, Consumer Reports, Electronic Privacy Information Center, Public Interest Research Group and Privacy Rights Clearinghouse. They all signed a letter in support of the Nebraska bill.
“The propagation of California Delete Act-style legislation is one of the most promising legislative developments for consumer privacy at the state level,” said Matt Schwartz, a Consumer Reports policy analyst who focuses on privacy. “[W]e are excited to continue to work with legislators to make that happen.”
Delete Act opponents include the American Association of Advertising Agencies, American Advertising Federation, Association of National Advertisers, Interactive Advertising Bureau and the Digital Advertising Alliance.
In a joint letter opposing the Nebraska bill, those groups called California’s law “novel, undeveloped, and untested” and warned that setting up a similar law in Nebraska would be “enormous and costly” for the secretary of state.
The groups also said that the Delete Act would hurt smaller businesses that depend on data brokers for customer leads.
“In large part due to services provided by data brokers, small and mid-sized businesses are empowered to compete with larger companies who have more resources to allocate to brand marketing efforts,” the letter said.
Kemp disagrees that the Delete Act is onerous. He said businesses will still have access to consumer data, just not personal data.
California’s one-stop portal is scheduled to go online in 2026. That’s when California consumers will be able to tell the nearly 500 registered data brokers in the state to delete their information.
Kemp said interest in passing the Delete Act in even more states will then surge.
“Once California hits, then people are going to be like, ‘Why does California have this really cool thing and we don’t,” Kemp said.