The DELETE Act aims to create a **centralized system** allowing individuals to request the simultaneous deletion of their personal information from all data brokers. The Federal Trade Commission (FTC) is tasked with establishing and regulating this system, seeking to provide individuals with greater control over their data held by third-party entities. It mandates specific requirements for data brokers regarding registration and compliance with deletion requests. Under the Act, data brokers must annually register with the FTC, providing details such as their name, addresses, methods for opting out of data collection or sales, and the types of information they collect and its sources. The FTC will make this registration information publicly available in a machine-readable format, though with a disclaimer about accuracy. The centralized system allows individuals to submit a single request to delete their personal information and discontinue future collection by all registered data brokers, utilizing standardized forms and hashed registries that data brokers can query. Upon matching a deletion request, data brokers and their affiliates must delete all personal information related to the individual within **31 days** and cease further collection, sending an affirmative representation to the FTC. Limited exclusions permit data retention for specific purposes, such as human subjects research, legal compliance, or fraud prevention, but such data cannot be used for other purposes like marketing. Data brokers must also submit annual reports on deletion completion rates and undergo independent third-party audits every three years. To fund the system, registered data brokers maintaining persistent identifiers will pay an annual subscription fee, capped at one percent of the system's operating cost. Violations of the Act are considered unfair or deceptive acts, granting the FTC enforcement powers. The Act also requires the FTC to study and report on its implementation and specifies that it preempts inconsistent state privacy laws, unless state law offers greater protection.
The DELETE Act aims to create a **centralized system** allowing individuals to request the simultaneous deletion of their personal information from all data brokers. The Federal Trade Commission (FTC) is tasked with establishing and regulating this system, seeking to provide individuals with greater control over their data held by third-party entities. It mandates specific requirements for data brokers regarding registration and compliance with deletion requests. Under the Act, data brokers must annually register with the FTC, providing details such as their name, addresses, methods for opting out of data collection or sales, and the types of information they collect and its sources. The FTC will make this registration information publicly available in a machine-readable format, though with a disclaimer about accuracy. The centralized system allows individuals to submit a single request to delete their personal information and discontinue future collection by all registered data brokers, utilizing standardized forms and hashed registries that data brokers can query. Upon matching a deletion request, data brokers and their affiliates must delete all personal information related to the individual within **31 days** and cease further collection, sending an affirmative representation to the FTC. Limited exclusions permit data retention for specific purposes, such as human subjects research, legal compliance, or fraud prevention, but such data cannot be used for other purposes like marketing. Data brokers must also submit annual reports on deletion completion rates and undergo independent third-party audits every three years. To fund the system, registered data brokers maintaining persistent identifiers will pay an annual subscription fee, capped at one percent of the system's operating cost. Violations of the Act are considered unfair or deceptive acts, granting the FTC enforcement powers. The Act also requires the FTC to study and report on its implementation and specifies that it preempts inconsistent state privacy laws, unless state law offers greater protection.