California Turns Data Deletion Into One…California Turns Data Deletion Into One RequestCoverage from CalMatters, Governor of California, and others
00/00/0000
DailyWeekly
California’s Delete Act established DROP, a state-run platform through which residents can request deletion of their information from registered data brokers in one step.
Starting August 1, 2026, brokers must retrieve and process requests, report their handling, and continue checking for newly acquired information; the state can impose daily penalties for noncompliance. The system centralizes requests across hundreds of brokers, though participation figures remain a small share of the state’s population and some records may be exempt from deletion.
It grounds the system’s enforcement dimension in reported penalties and concrete data-broker actions.
Lexology / John P. Carlin, David Kessler, Ian C. Richardson, Jacobus "Janus" Schutte, Audrey M. Paquet, Maggie Lu, Michael Shepard
Key Issues
01
DROP makes broker deletion a recurring obligation
DROP lets one resident request reach hundreds of registered brokers, which must process covered deletions and check regularly for newly acquired matching data. The centralized process is operational, but applies within the Delete Act’s broker and data coverage.
Stable
Drawn from 3 articles
02
Broker privacy duties face active enforcement
California regulators are imposing penalties and corrective duties for broker registration failures and barriers to exercising privacy rights. DROP’s practical force therefore depends on continued compliance and regulator follow-through, not only on the centralized request mechanism.
Stable
Drawn from 3 articles
03
Participation and coverage limit DROP’s reach
Reported signups remain below 1% of California’s population, and statutory exemptions and broker-registration boundaries mean the platform cannot reach every record or data holder. The one-stop process reduces friction for participants but does not ensure comprehensive removal.
Stable
Drawn from 3 articles
04
Website-tracking liability may narrow, but remains unsettled
SB 690 would remove private CIPA pen-register claims for certain website and app conduct, potentially affecting pending cases, while other CIPA and privacy claims remain available. The latest supplied reporting says the bill was still awaiting gubernatorial action, so that proposed enforcement shift was not yet settled law.
Stable
Drawn from 4 articles
Key Numbers
August 21, 2026
date of tentative ruling
“In a tentative ruling issued August 21, 2026, the California Court of Appeal rejected the categorical argument that CIPA’s pen-register provisions apply only to telephone systems, while also concluding that IP-address collection alone does not establish a valid pen-register claim.”
Mondaq and 1 other article
$116,490 USD
total penalty against LocateSmarter
Delete Act and CCPA violations
“The California Privacy Protection Agency (CalPrivacy) announced its first enforcement action against a data broker under the California Consumer Privacy Act (CCPA), fining Iowa-based LocateSmarter LLC $116,490.”
Lexology
$30,600 USD
Delete Act penalty
LocateSmarter stipulated final order
“The stipulated final order requires LocateSmarter to pay $30,600 for the Delete Act violation and $79,890 for the CCPA violations. It must register as a data broker, disclose metrics about CCPA requests, process deletion requests submitted through DROP, and make its opt-out process easy and minimally burdensome.”
Lexology
$79,890 USD
CCPA penalty
LocateSmarter stipulated final order
“The stipulated final order requires LocateSmarter to pay $30,600 for the Delete Act violation and $79,890 for the CCPA violations. It must register as a data broker, disclose metrics about CCPA requests, process deletion requests submitted through DROP, and make its opt-out process easy and minimally burdensome.”
Lexology
January 1, 2025
cutoff date for lawsuits covered by the proposed retroactive change
lawsuits filed on or after
“Separately, lawmakers passed SB 690, which would eliminate the private right of action for CIPA pen register claims and apply retroactively to pending lawsuits filed on or after January 1, 2025.”
Fisher Phillips
Contested Issue
1 open dispute
After a resident submits a DROP request, do brokers have 45 days or up to 90 days to complete the deletion?
The corpus includes accounts describing a 45-day deadline to process a request and others describing a two-stage process—up to 45 days to retrieve it and another 45 days to process it—allowing up to 90 days overall.
45-day completion
3 articles · across 3 publications
Brokers must complete covered deletions within 45 days of receiving the request.
Up to 90-day completion
3 articles · across 3 publications
Brokers may take up to 90 days overall: up to 45 days to retrieve the request from DROP, followed by up to 45 days to process it.
Looking Back
1077 Day Timeline
Articles published over time. Hover any bar for the period and its article count.
Oct '23
Apr '24
Oct '24
Apr '25
Oct '25
Apr '26
Sep '26
The Story So Far
No material change
SB 923 expands California’s separate CCPA deletion right, but the new information does not change DROP’s broker-focused process or obligations.
Previously
California’s Delete Act established DROP, a state-run platform through which residents can request deletion of their information from registered data brokers in one step. Starting August 1, 2026, brokers must retrieve and process requests, report their handling, and continue checking for newly acquired information; the state can impose daily penalties for noncompliance. The system centralizes requests across hundreds of brokers, though participation figures remain a small share of the state’s population and some records may be exempt from deletion.
History
09/28/2026
The update adds context that uptake remains below 1% of California’s population and that some records may be exempt from deletion. The processing start and broker obligations largely confirm the previous account.
09/17/2026
The current version largely confirms the existing implementation story, while clarifying the program’s scale and framing related tracking disputes across a broader set of online tools.
California lawmakers sent Senate Bill 690 to Governor Gavin Newsom in Sacramento after debate over whether CIPA reform would protect small businesses or weaken consumer privacy enforcement.
9/3/2026 • Regulation, Law & Enforcement • General
California's Privacy Protection Agency fined LocateSmarter in California's first Delete Act-era data-broker action for obstructing opt-outs and failing to register.
8/13/2026 • Regulation, Law & Enforcement • General
Between September 2 and September 14, 2026, five California privacy bills were presented to Governor Gavin Newsom after legislative passage, and remained unenacted as of September 24.
9/24/2026 • Regulation, Law & Enforcement • General
California lawmakers advanced SB 690 to restrict private online pen-register lawsuits statewide beginning January 1, 2027, while preserving wiretap claims and Attorney General enforcement.
9/20/2026 • Regulation, Law & Enforcement • General
Lexology / John P. Carlin, David Kessler, Ian C. Richardson, Jacobus "Janus" Schutte, Audrey M. Paquet, Maggie Lu, Michael Shepard70
California's privacy regulator fined LocateSmarter and Cybba in 2026 for data-broker registration failures and practices obstructing consumer deletion and opt-out rights.
9/9/2026 • Regulation, Law & Enforcement • General
California's Legislature passed SB 923, SB 690, and AB 2561 in August 2026, sending three privacy measures to the Governor for potential statewide effect in January 2027.
9/2/2026 • Regulation, Law & Enforcement • General
Goodwin / Ryan D. Ball, Gabe Maldoff, Mark David McPherson, W. Kyle Tayman, Omer Tene, Rebecca Tarneja, Sophie Barnett, Noelle Wilson70
The California Legislature passed Senate Bill 690 on August 28, 2026, in California, limiting private lawsuits over online tracking and assigning covered enforcement to the Attorney General.
9/1/2026 • Regulation, Law & Enforcement • General
The California Court of Appeal heard arguments on August 25, 2026, in Sean Rose's challenge involving Variety Media website trackers and CIPA liability in California.
8/31/2026 • Regulation, Law & Enforcement • General
California residents began using the California Delete Request and Opt-Out Platform in January 2026 to direct registered data brokers statewide to delete personal information.
8/4/2026 • Regulation, Law & Enforcement • General
Privacy and Data Security Insights / Kennedy Brooks70
California, New Jersey, Connecticut, Vermont, and federal regulators expanded data broker privacy obligations during 2026 through registration, deletion, breach, and foreign-adversary data sale controls.
8/4/2026 • Regulation, Law & Enforcement • General
California's privacy system began requiring registered data brokers to process centralized consumer deletion requests on August 1 through the statewide DROP platform.
8/3/2026 • Regulation, Law & Enforcement • General
CalPrivacy announced a July 21, 2026 CCPA compliance audit of gig economy platforms in California to test right-to-know fulfillment and 45-day response timelines.
7/21/2026 • Regulation, Law & Enforcement • General
CalPrivacy began a first CCPA privacy audit of gig platforms in California to verify timely, complete access to personal information for consumers and independent contractor workers.
7/21/2026 • Regulation, Law & Enforcement • General
California’s Delete Act takes effect August 1, requiring data brokers to delete records tied to DROP deletion requests submitted by California residents.
7/20/2026 • Regulation, Law & Enforcement • General
California’s Delete Act takes effect on Aug. 1, requiring data brokers to delete residents’ personal data, enforced by the California Privacy Protection Agency and the state attorney general.
7/16/2026 • Regulation, Law & Enforcement • General
California data brokers must begin Aug. 1 deletion processing via DROP under CalPrivacy requirements, converting broker deletion into recurring 45-day workflows with 2028 audits.
7/3/2026 • Regulation, Law & Enforcement • General
California businesses were sued under CIPA for website tracking and analytics as SB 690 faced support from Stop CIPA Shakedowns and opposition from Oakland Privacy advocates.
6/18/2026 • Regulation, Law & Enforcement • General
On June 3, House lawmakers heard testimony as the SECURE Data Act and GUARD Financial Data Act face criticism for excluding derived-profile data aggregators from protections.
6/10/2026 • Regulation, Law & Enforcement • General
On August 11, 2026, CalPrivacy ordered Iowa-based LocateSmarter LLC to pay $116,490 for California Delete Act and CCPA violations involving registration and opt-out barriers.
8/14/2026 • Regulation, Law & Enforcement • General
The California Privacy Protection Agency Board, meeting May 1, 2026, outlined expanded enforcement against data brokers and privacy-rights failures, with future DELETE Act deletion obligations.
5/20/2026 • Regulation, Law & Enforcement • General
California will begin imposing daily penalties on noncompliant data brokers in August for delayed deletion requests and inadequate explanations of denials.
8/4/2026 • Regulation, Law & Enforcement • General
California Senate Privacy Committee advanced SB 690 on July 2, aiming to narrow CIPA claims tied to website tracking amid debate over consumer privacy protections.
7/27/2026 • Regulation, Law & Enforcement • General
Alston / Rachel Lowe, Daniel J. Felz, Jonathan J. Kim, Tracy Yao64
California legislators are considering SB 690 in 2025 to limit private CIPA pen-register claims statewide while courts examine website tracking disputes in Los Angeles and California.
7/27/2026 • Regulation, Law & Enforcement • General
U.S. and California courts continue to diverge on whether CIPA covers website tracking pixels as Mirmalek settles and appellate cases prepare first rulings.
7/14/2026 • Regulation, Law & Enforcement • General
California Privacy Protection Agency launches the Delete Request and Opt-out Platform to centralize deletion requests from data brokers registered in California on January 1, 2026.
3/5/2026 • Regulation, Law & Enforcement • General
CalPrivacy Executive Director Tom Kemp detailed in California how the DROP deletion platform, new audit division, and phased risk assessments will reinforce CCPA enforcement against data brokers and businesses starting in 2026.
1/1/2026 • Regulation, Law & Enforcement • General
Wilson Sonsini Goodrich & Rosati Professional Corporation Home Page - Palo Alto / Tracy Shapiro64
The California Privacy Protection Agency adopted Delete Act broker regulations on Nov. 8, 2024, in Sacramento, expanding broker definitions, increasing fees, and mandating a state opt-out deletion platform.
1/1/1900 • Regulation, Law & Enforcement • General
California lawmakers passed SB 690 unanimously in August in Sacramento, sending the privacy litigation measure to Governor Gavin Newsom for consideration.
8/31/2026 • Regulation, Law & Enforcement • General
The California Privacy Protection Agency Board fined Iowa data broker LocateSmarter $116,490 in California for late registration and obstructing consumer opt-out requests.
8/18/2026 • Regulation, Law & Enforcement • General
Vivek Shah and other plaintiffs use CIPA theories to sue businesses nationwide over third-party tracking scripts and form data transmission, with California SB 690 under consideration in 2026.
7/17/2026 • Regulation, Law & Enforcement • General
The California Privacy Protection Agency ordered data broker Background Alert to shut down for three years in 2024 after noncompliance with California Delete Act registration requirements.
2/28/2025 • Regulation, Law & Enforcement • General
California launched DROP in 2026, allowing California residents to send centralized deletion and opt-out requests to registered data brokers statewide.
8/3/2026 • Consumer Privacy & Digital Rights • General
California Assembly Privacy and Consumer Protection Committee passed amended Senate Bill 690 on July 1, 2026, narrowing CIPA private lawsuits tied to Section 638.51 website and app conduct.
7/7/2026 • Regulation, Law & Enforcement • General
California Privacy Protection Agency administers DROP, a centralized system requiring registered data brokers to process deletion requests starting Aug. 1, 2026.
5/4/2026 • Consumer Privacy & Digital Rights • General
On May 1, 2026, California Privacy Protection Agency Board reviewed expanded enforcement plans centered on data brokers, statutory deletion and opt-out rights, and future DELETE Act global deletion integration.
5/19/2026 • Regulation, Law & Enforcement • General
California data brokers denied or ignored more than one million deletion requests, prompting state enforcement through the DROP platform beginning August 1.
7/31/2026 • Consumer Privacy & Digital Rights • General
California's SB 362 will require registered data brokers to delete sensitive personal data through the DROP system starting after August 1, with $200-per-day penalties for failures.
7/13/2026 • Consumer Privacy & Digital Rights • General
Privacy and Data Security Insights / Zachary Heck63
California lawmakers passed SB 690 on August 28, 2026, limiting private CIPA pen register claims over website and application tracking, subject to Governor Gavin Newsom's action.
9/15/2026 • Regulation, Law & Enforcement • General
Legal500 / Akin; Natasha Kohne; Laura D. Smolowe; Evan D. Wolff; Virgil A. Miller; Rita S. Heimes; Caroline Wolverton; Chris Barwick; David Korin63
California lawmakers passed SB 690 in 2026 to limit private website-tracking lawsuits, while Governor Gavin Newsom considers the measure before September 30, 2026.
9/15/2026 • Regulation, Law & Enforcement • General
The California Legislature passed SB 690 on August 28, 2026, restricting private online-tracking claims statewide while awaiting Governor Gavin Newsom's action.
9/16/2026 • Regulation, Law & Enforcement • General
Mondaq / Natasha G. Kohne, Laura D. Smolowe, Virgil A. Miller62
California lawmakers passed SB 690 in Sacramento on August 28, 2026, limiting private website-tracking pen-register lawsuits while companion bills add privacy duties.
9/15/2026 • Regulation, Law & Enforcement • General
California lawmakers passed SB 690 on August 28, 2026, narrowing private enforcement of certain website and application CIPA claims while awaiting Governor Gavin Newsom's action.
9/8/2026 • Regulation, Law & Enforcement • General
Mondaq / Stephanie A. Sheridan, Meegan Brooks, Christine Wang62
California lawmakers passed SB 690 in August 2026 to limit private CIPA tracking lawsuits, while a California appellate court considered online tools potentially covered by pen-register rules.
9/7/2026 • Regulation, Law & Enforcement • General
California launched the DROP platform on August 1, 2026, enabling California consumers to send centralized deletion requests to data brokers under recurring state oversight.
8/5/2026 • Regulation, Law & Enforcement • General
CalPrivacy signaled intensified data broker delete-right and registration enforcement on 1 May while opposing the SECURE Data Act and evaluating EU adequacy prospects.
5/4/2026 • Regulation, Law & Enforcement • General
CalPrivacy Director Tom Kemp announced California's DROP deletion platform and new audit division on behalf of the California agency in 2026 to enforce CCPA compliance across the state.
1/1/2026 • Regulation, Law & Enforcement • General
On August 1, 2026, the California Privacy Protection Agency launched DROP in California to centralize consumer deletion and opt-out requests for registered data brokers.
8/10/2026 • Regulation, Law & Enforcement • General
California lawmakers are considering Senate Bill 690, which would restrict private enforcement of online tracking claims under the California Invasion of Privacy Act and affect lawsuits nationwide.
8/3/2026 • Regulation, Law & Enforcement • General
California lawmakers proposed AB 1542 and SB 1106 to restrict sensitive-data sharing and accelerate data-broker deletion processing under CPPA enforcement.
5/12/2026 • Regulation, Law & Enforcement • General
Cory Doctorow criticizes California DROP for data-broker deletion requests that rely on extensive identity verification through Login.gov and related steps.
7/23/2026 • Consumer Privacy & Digital Rights • General
Alston & Bird / Cynthia J. Cole, Yin Zhao Tydir, Santiago “Santi” Villar57
A 2026 privacy assessment found that California data brokers obstruct consumer rights requests and fail to meet disclosure obligations under state law.
8/11/2026 • Corporate Data Practices & Accountability • General
Mondaq / Cynthia Cole, Yin Zhao Tydir, and Santiago “Santi” Villar56
The California Privacy Protection Agency advanced opt-out and data broker rulemaking in California on August 6-7, 2026, expanding compliance and enforcement requirements.
8/17/2026 • Regulation, Law & Enforcement • General
California's DROP platform allows residents to submit a single deletion request to data brokers, aligning CCPA with GDPR-style rights while enforcement remains critical.
3/3/2026 • Consumer Privacy & Digital Rights • General
California CPPA launched the DROP portal for data broker deletion while CPPA compliance rules expanded and CIPA tracking lawsuits continued through early 2026.
5/14/2026 • Regulation, Law & Enforcement • General
Coalition reported in 2026 that California businesses and overseas website operators face expanding CIPA tracking claims, while Sacramento lawmakers consider partial reforms.
8/10/2026 • Regulation, Law & Enforcement • General
AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
