Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 12:00 PM EST
California Forces Data Broker Deletions
Coverage from Hunton Andrews Kurth LLP, Newsweek, and others
Articles
37
Active Days
1014
The Topic
California is using the Delete Act and its Delete Request and Opt-out Platform to give residents a single process for removing personal information held by registered data brokers. The program is moving from registration and early sign-ups toward broker compliance, deletion sweeps, and enforcement, including penalties for failures to register or delete data. Its implementation could establish a model for other states while increasing operational and regulatory pressure on the data brokerage industry.
First Article: 01/01/00
Latest Article: 07/27/26
Summary
- DROP allows California residents to submit one deletion and opt-out request covering registered data brokers.
- More than 575 brokers have registered, while hundreds of thousands of residents have signed up or submitted requests, according to agency updates.
- Brokers must begin honoring requests and conducting recurring deletion sweeps from August 1, 2026.
- Failure to register or delete covered data can lead to daily, per-person penalties and other enforcement actions.
- The California Privacy Protection Agency is expanding investigations, technical oversight, and a dedicated data broker enforcement strike force.
- The program covers sensitive information including location, identity, health-related, reproductive-health, and minors’ data where held by covered brokers.
- Connecticut and other states are considering California-style registration, deletion, or opt-out systems.
History
The story has shifted from a general rollout of California’s DROP system to a more operational phase, with enforcement, compliance sweeps, and penalties now taking center stage. It also newly highlights that the program covers especially sensitive categories of personal data and that other states are actively considering similar systems.
The story has shifted from general implementation of California’s Delete Act to a more concrete, enforcement-centered phase: DROP now has a firm start date for deletion processing, and regulators are explicitly extending pressure to unregistered brokers. The framing also broadens from California-only compliance to a potential model for other states amid limited federal action.
Featured
07-21-2026
CalPrivacy announced a July 21, 2026 CCPA compliance audit of gig economy platforms in California to test right-to-know fulfillment and 45-day response timelines.
07-13-2026
California's SB 362 will require registered data brokers to delete sensitive personal data through the DROP system starting after August 1, with $200-per-day penalties for failures.
03-06-2026
California Privacy Protection Agency requires data brokers to comply with deletion requests via DROP starting August 1 2026 in California.
Timeline: 1014 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
The California Privacy Protection Agency Board, meeting May 1, 2026, outlined expanded enforcement against data brokers and privacy-rights failures, with future DELETE Act deletion obligations.
The California Privacy Protection Agency ordered data broker Background Alert to shut down for three years in 2024 after noncompliance with California Delete Act registration requirements.
CalPrivacy Executive Director Tom Kemp detailed in California how the DROP deletion platform, new audit division, and phased risk assessments will reinforce CCPA enforcement against data brokers and businesses starting in 2026.
The California Privacy Protection Agency adopted Delete Act broker regulations on Nov. 8, 2024, in Sacramento, expanding broker definitions, increasing fees, and mandating a state opt-out deletion platform.
California Privacy Protection Agency launches the Delete Request and Opt-out Platform to centralize deletion requests from data brokers registered in California on January 1, 2026.
California privacy enforcement under SB 362 requires registered data brokers to process deletion requests starting after August 1 using DROP.
Data brokers must comply with California DROP obligations beginning in 2026 to govern deletion, record matching, and service provider contracts.
California state government enacted Senate Bill 362 on October 10 2023 to create a one stop deletion mechanism for data brokers.
California Privacy Protection Agency and Tom Kemp prepare mandatory data broker deletions under DROP starting Aug. 1, 2026 for enrolled residents.
California businesses were sued under CIPA for website tracking and analytics as SB 690 faced support from Stop CIPA Shakedowns and opposition from Oakland Privacy advocates.
California data brokers must begin Aug. 1 deletion processing via DROP under CalPrivacy requirements, converting broker deletion into recurring 45-day workflows with 2028 audits.
CalPrivacy began a first CCPA privacy audit of gig platforms in California to verify timely, complete access to personal information for consumers and independent contractor workers.
California’s Delete Act takes effect on Aug. 1, requiring data brokers to delete residents’ personal data, enforced by the California Privacy Protection Agency and the state attorney general.
On June 3, House lawmakers heard testimony as the SECURE Data Act and GUARD Financial Data Act face criticism for excluding derived-profile data aggregators from protections.
California’s Delete Act takes effect August 1, requiring data brokers to delete records tied to DROP deletion requests submitted by California residents.
California Senate Privacy Committee advanced SB 690 on July 2, aiming to narrow CIPA claims tied to website tracking amid debate over consumer privacy protections.
California Privacy Protection Agency administers DROP, a centralized system requiring registered data brokers to process deletion requests starting Aug. 1, 2026.
UC Irvine researchers in California report low broker response rates and recurring opt-out deadline misses for deletion and opt-out requests.
California Assembly Privacy and Consumer Protection Committee passed SB 690 on July 1, 2026 to narrow CIPA cookie and pixel litigation.
Vivek Shah and other plaintiffs use CIPA theories to sue businesses nationwide over third-party tracking scripts and form data transmission, with California SB 690 under consideration in 2026.
On May 1, 2026, California Privacy Protection Agency Board reviewed expanded enforcement plans centered on data brokers, statutory deletion and opt-out rights, and future DELETE Act global deletion integration.
Starting August 1, 2026, California data brokers must access DROP at least every 45 days to process consumer deletion requests under the Delete Act.
Cory Doctorow criticizes California DROP for data-broker deletion requests that rely on extensive identity verification through Login.gov and related steps.
U.S. and California courts continue to diverge on whether CIPA covers website tracking pixels as Mirmalek settles and appellate cases prepare first rulings.
California Assembly Privacy and Consumer Protection Committee passed amended Senate Bill 690 on July 1, 2026, narrowing CIPA private lawsuits tied to Section 638.51 website and app conduct.
⭐⭐⭐
CalPrivacy Director Tom Kemp announced California's DROP deletion platform and new audit division on behalf of the California agency in 2026 to enforce CCPA compliance across the state.
CalPrivacy moves to enforce the California Delete Act Delete Request and Opt-Out Platform in California, beginning enforcement later this year.
CPPA establishes data broker enforcement strike force in California to enforce Delete Act beginning 2024, with DROP platform launching in 2026.
California residents enroll in DROP to delete personal data from data brokers in California, with enforcement starting in August 2026.
CalPrivacy signaled intensified data broker delete-right and registration enforcement on 1 May while opposing the SECURE Data Act and evaluating EU adequacy prospects.
California's DROP platform allows residents to submit a single deletion request to data brokers, aligning CCPA with GDPR-style rights while enforcement remains critical.
California lawmakers proposed AB 1542 and SB 1106 to tighten CCPA sensitive-data sharing and shorten data-broker deletion-request timelines in 2026.
California lawmakers proposed AB 1542 and SB 1106 to restrict sensitive-data sharing and accelerate data-broker deletion processing under CPPA enforcement.
California CPPA launched the DROP portal for data broker deletion while CPPA compliance rules expanded and CIPA tracking lawsuits continued through early 2026.