Delete Act: California Delete Act (Data Broker Registration)
California law requiring data brokers to register annually with CalPrivacy and to process consumer deletion requests submitted through DROP, the state deletion mechanism.
Delete Act citations (2)
Data Broker Registration
A business that meets the definition of a data broker in a given year must register with the California Privacy Protection Agency on or before January 31 of the following year, pay a registration fee, and disclose what it collects and to whom it sells or shares. A broker that fails to register is liable for an administrative fine of $200 for each day it is unregistered, the fees that went unpaid, and the Agency's investigation costs; a broker that fails to process deletion requests under § 1798.99.86 is liable for $200 per request for each day it fails to delete. Registering is not the end of the exposure: the Agency reads "fails to register as required by this section" to reach a registration that carries wrong information, and its Enforcement Advisory 2026-01 (September 3, 2026) warns that a broker owes the $200 daily fine for each day incorrect information remains in the registry.
Accessible Deletion Mechanism (DROP)
The California Privacy Protection Agency must run an accessible deletion mechanism, DROP, that lets a consumer ask every registered data broker to delete their personal information through a single verifiable request, free of charge. Beginning August 1, 2026, a data broker must access DROP at least once every 45 days, process each deletion request within 45 days, treat an unverifiable request as an opt-out of sale or sharing, pass deletions on to its service providers and contractors, and keep deleting the consumer's data every 45 days afterward. AB 883 (Lowenthal), signed September 27, 2026 as Stats. 2026, Ch. 507, shortens every one of those 45-day intervals to 30 days from January 1, 2027. It also adds § 1798.99.86.5, operative July 1, 2027, which has state and local officials tell elected officials and judges that they can use DROP and lets the Attorney General, a county counsel, or a city attorney sue a broker that fails to delete an official's or judge's data. Until January 1, 2027 the 45-day text quoted here is the duty in force.
Legal notice: This reference library is for informational purposes only and does not constitute legal advice. Excerpts are reproduced from official public sources and are current as of January 2026. Laws and regulations change: always verify against the authoritative source and consult a qualified attorney.