Delete Act: California Delete Act (Data Broker Registration)
California law requiring data brokers to register annually with CalPrivacy and to process consumer deletion requests submitted through DROP, the state deletion mechanism.
Delete Act citations (2)
Data Broker Registration
A business that meets the definition of a data broker in a given year must register with the California Privacy Protection Agency on or before January 31 of the following year, pay a registration fee, and disclose what it collects and to whom it sells or shares. A broker that fails to register is liable for an administrative fine of $200 for each day it is unregistered, the fees that went unpaid, and the Agency's investigation costs; a broker that fails to process deletion requests under § 1798.99.86 is liable for $200 per request for each day it fails to delete.
Accessible Deletion Mechanism (DROP)
The California Privacy Protection Agency must run an accessible deletion mechanism, DROP, that lets a consumer ask every registered data broker to delete their personal information through a single verifiable request, free of charge. Beginning August 1, 2026, a data broker must access DROP at least once every 45 days, process each deletion request within 45 days, treat an unverifiable request as an opt-out of sale or sharing, pass deletions on to its service providers and contractors, and keep deleting the consumer's data every 45 days afterward.
Legal notice: This reference library is for informational purposes only and does not constitute legal advice. Excerpts are reproduced from official public sources and are current as of January 2026. Laws and regulations change: always verify against the authoritative source and consult a qualified attorney.