California AB 656, the Delete Act and EDPS Generative AI Guidance

California signs social media account deletion law

What's New?

Governor Gavin Newsom signed AB 656 on October 8, 2025, so it is a signed law, not a bill. According to the Governor's office, it requires social media companies to make canceling an account straightforward and clear, and cancellation must trigger full deletion of the user's personal data. Law firm summaries add that the law applies to large platforms, requires a clearly placed "Delete Account" button and bans dark patterns that obstruct deletion.

Why It Matters

Interpretation: deletion here means erasure, not deactivation. A covered platform cannot simply hide a profile and keep the underlying data for analytics, beyond the narrow exceptions the CCPA itself allows. For organizations operating in the U.S., California moves closer to a European-style right to erasure.

Recommended Action

Check that your "Delete Account" flow triggers full erasure across all sub-processors, not only in the main system.

Delete Act: data broker deletion requests start August 2026

What's New?

California's Delete Act (SB 362, enacted in 2023) gives residents a single route to ask all registered data brokers to delete their data. The California Privacy Protection Agency states that residents can use its platform, DROP, to submit one deletion request to all active brokers, and that brokers must begin processing these requests on August 1, 2026.

Why It Matters

This is the broker-side counterpart to AB 656. The obligation to act on requests is a published requirement with a fixed start date, and it applies to brokers, not to platforms covered by AB 656.

Recommended Action

If you act as a data broker in California, confirm that your registration is in order and that you can process requests received through DROP from August 1, 2026.

EDPS revises its generative AI guidance

What's New?

The European Data Protection Supervisor (EDPS) published revised guidance on generative AI on October 28, 2025. It is guidance, not a binding decision, and it is addressed to EU institutions, bodies, offices and agencies, to help them comply with Regulation (EU) 2018/1725. The revision refines the definition of generative AI, adds a compliance checklist, clarifies controller and processor roles, and gives detailed recommendations on lawful processing and individuals' rights.

Why It Matters

Interpretation: the guidance is not addressed to private organizations, but it shows how the EDPS approaches generative AI, and similar questions about lawful basis, roles and individual rights arise for any organization deploying these tools.

Recommended Action

Before deploying a generative AI tool, run a Data Protection Impact Assessment and set clear rules on what data may be entered into it.