Georgetown Law
Technology Review

Most people are unaware that thousands of companies, of which they have never heard or interacted, profit off of their most sensitive personal data. Data brokers amass personal data from disparate sources, such as social media sites and credit reporting agencies, and sell the resulting individualized dossiers to anyone willing to pay. The resulting data can easily be weaponized to fuel fraud scams, harassment, and stalking. But in the absence of a federal privacy law, individuals in the United States have no legal means to request that data brokers delete their most sensitive data.

California’s Delete Act, SB-362, passed in 2024, aims to solve this problem by requiring all data brokers to delete residents’ data upon request. This Article treats California’s Delete Act as prototypical legislation, as several other states are well-poised to pass similar laws as part of their privacy framework. But celebration may be premature. Well-funded litigants, including data brokers and trade associations, will likely argue that the Delete Act violates the First Amendment by limiting the sale of personal data. Prior interpretations of privacy laws by the Supreme Court indicate that the Delete Act could indeed be vulnerable to such challenges.

This Article anticipates those challenges and finds that legislation limiting data brokers’ sale of personal data is constitutional under the First Amendment. Courts should maintain this understanding of the interaction between the First Amendment and privacy legislation, lest all regulations, especially in the digital age, be interpreted as constitutional violations. Privacy protections like the Delete Act can, and do, coexist with the Constitution’s protection of free expression.