Delete Act § 1798.99.86
Accessible Deletion Mechanism (DROP)
Reference only. The Privisy audit does not test this section.
- Source
- Statute
- In force from
- January 1, 2026
- Last reviewed
- September 2026
- Framework
- Delete Act
What it requires
The California Privacy Protection Agency must run an accessible deletion mechanism, DROP, that lets a consumer ask every registered data broker to delete their personal information through a single verifiable request, free of charge. Beginning August 1, 2026, a data broker must access DROP at least once every 45 days, process each deletion request within 45 days, treat an unverifiable request as an opt-out of sale or sharing, pass deletions on to its service providers and contractors, and keep deleting the consumer's data every 45 days afterward. AB 883 (Lowenthal), signed September 27, 2026 as Stats. 2026, Ch. 507, shortens every one of those 45-day intervals to 30 days from January 1, 2027. It also adds § 1798.99.86.5, operative July 1, 2027, which has state and local officials tell elected officials and judges that they can use DROP and lets the Attorney General, a county counsel, or a city attorney sue a broker that fails to delete an official's or judge's data. Until January 1, 2027 the 45-day text quoted here is the duty in force.
Statute text
(c) (1) Beginning August 1, 2026, a data broker shall access the accessible deletion mechanism established pursuant to subdivision (a) at least once every 45 days and do all of the following: (A) Within 45 days after receiving a request made pursuant to this section, process all deletion requests made pursuant to this section and delete all personal information related to the consumers making the requests consistent with the requirements of this section. [...] (d) (1) Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall delete all personal information of the consumer at least once every 45 days pursuant to this section unless the consumer requests otherwise or the deletion is not required pursuant to paragraph (2) of subdivision (c).
California Delete Act (Data Broker Registration), § 1798.99.86Read the full section from California Privacy Protection Agency (CalPrivacy)
This page is for information only and is not legal advice. The excerpt is reproduced from official public sources and was checked against them on the last-reviewed date above. Laws change: check the authoritative source and consult a licensed attorney for compliance guidance.