California Delete Act: Data Brokers Must Process Deletion Requests Through DROP
From August 1, 2026, data brokers registered in California must access the Delete Request and Opt-Out Platform (DROP) and act on the consumer deletion requests it holds. DROP is the accessible deletion mechanism required by the Delete Act (SB 362, signed October 2023) and built by the California Privacy Protection Agency, which had to stand it up for consumer use by January 1, 2026. A single verified consumer request now reaches every registered broker at once. Brokers must check the mechanism at least once every 45 days, delete a requesting consumer's personal information within 45 days, and keep deleting any newly acquired information about that consumer on the same 45-day cycle.
Key Analytics
Impact Analysis
The obligation to keep deleting is the part that changes system design. A one-time purge does not satisfy the statute: a broker that re-acquires a consumer's record from a downstream source has to remove it again on the next cycle, which means the deletion list has to persist and be applied to incoming data rather than run as a batch job against the current database. The broader risk is scope. Companies routinely assume the data broker definition does not describe them, and the test is whether personal information is knowingly sold about consumers with whom the business has no direct relationship. Enrichment vendors, audience and lead-generation platforms, and analytics providers that resell derived attributes have all found themselves inside that definition. Registration status is public, so a company that concludes it is out of scope should be able to show why.
Recommended Actions
- Determine whether your business meets California's data broker definition, which turns on selling personal information about consumers you have no direct relationship with, and document the conclusion either way
- If registered, implement the 45-day cycle as a recurring process against DROP rather than a one-off deletion project
- Design deletion to persist, so that a consumer's request continues to suppress records re-acquired from downstream sources on each subsequent cycle
- Map which internal systems and which onward recipients hold broker-sourced records, since deletion has to reach all of them
- Confirm your registration details with the CPPA are current, as registration is public and mismatches are visible to regulators and journalists alike
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Gap assessment against current controls
- ›Readiness assessment
- ›Remediation sprint to date
- ›Attestation or filing preparation
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 60 to 165 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.