California Forces Data Broker Deletions

The story has shifted from a general rollout of California’s DROP system to a more operational phase, with enforcement, compliance sweeps, and penalties now taking center stage. It also newly highlights that the program covers especially sensitive categories of personal data and that other states are actively considering similar systems.

The story has shifted from general implementation of California’s Delete Act to a more concrete, enforcement-centered phase: DROP now has a firm start date for deletion processing, and regulators are explicitly extending pressure to unregistered brokers. The framing also broadens from California-only compliance to a potential model for other states amid limited federal action.

• Broker deletion processing begins August 1, 2026.
• Noncompliance penalties can reach $200 per affected person per day.
• CPPA is using a dedicated data broker strike force.
• Other states are considering California-style data broker rules.
• Federal data broker regulation remains limited.

The story now adds concrete implementation and enforcement detail: CPPA is not only running DROP but also broadening broker compliance obligations through audits, deadlines, penalties, and shutdown actions. It also newly splits out a parallel California tracking-litigation thread, showing the broader privacy fight extends beyond data brokers.

• Expanded broker definitions and audit requirements were added.
• Shutdown and settlement actions against noncompliant brokers are now mentioned.
• Separate litigation over website tracking and pixels under CIPA is now included.
• California courts and ad-tech vendors are newly part of the story.
• Mandatory broker processing schedules are now described as in place.

The story has shifted from a narrow focus on DROP uptake and broker compliance into a broader enforcement regime, with CPPA actions now extending to privacy-rights violations beyond registration and deletion. California is also adding adjacent compliance layers and widening the policy frame with federal and cross-border privacy implications.

• CPPA is investigating privacy-rights failures beyond broker registration.
• California is adding cybersecurity audit, risk-assessment, and automated decision-making requirements.
• Cross-border EU adequacy and federal preemption concerns are now part of the story.
• Legislative proposals remain pending, with enactment uncertain.

The cluster is dominated by California's operational rollout of the Delete Act through the DROP platform, paired with increasingly active CPPA enforcement against data brokers. The current signal centers on growing resident participation, broker registration and compliance deadlines, strike-force-led enforcement, and additional legislative proposals that would further tighten deletion timelines and sensitive-data limits.