Cal. Code Regs. tit. 11, § 7616 – Additional Data Broker Requirements.

(a) A data broker must only use consumer personal information provided by the Agency, through a consumer deletion list or otherwise, for purposes of complying with Civil Code section 1798.99.86. Selling or sharing consumer personal information provided by the Agency is prohibited.
(b) A data broker must implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information provided by the Agency, to protect such personal information from unauthorized access, destruction, use, modification, or disclosure.
(c) A data broker shall not contact a consumer to verify their deletion requests submitted through the DROP.

Note: Authority cited: Section 1798.99.87, Civil Code. Reference: Section 1798.99.86, Civil Code.

1. New section filed 11-6-2025; operative 1-1-2026 (Register 2025, No. 45).