The Breakdown
The bill cleared the legislature on Thursday afternoon and was signed the same week. In plain terms: once you close an account, a company has a fixed window to delete the personal data it held for that account, and it cannot keep using that data to build advertising profiles after the window closes.
There are carve-outs. Anything a company is legally required to retain (tax records, transaction histories, safety reports) is exempt. So is data that has been aggregated to the point where it can no longer be traced back to an individual, which is a broader exemption than it sounds.
The version circulating online includes a clause about biometric data that was cut in committee weeks ago. That clause is not law. Several large accounts have shared screenshots of the earlier draft without noting the change.
Enforcement sits with the state attorney general and does not begin immediately; companies have a compliance runway before penalties attach. What that means in practice is that nothing visible changes for most people this month.
What to actually watch: whether the aggregation exemption gets tested. That is the provision most likely to decide whether this law does anything at all.
- Who
- State legislature and the governor
- What
- A data-retention limit that starts when an account is closed
- Where
- California, statewide
Harvey’s Take · Commentary, not reporting
They didn't hide the bill. They wrote it boring so nobody would read it. That's the whole strategy and it works every single time.
