Accessible Deletion Mechanism (DROP)

What it requires

The California Privacy Protection Agency must run an accessible deletion mechanism, DROP, that lets a consumer ask every registered data broker to delete their personal information through a single verifiable request, free of charge. Beginning August 1, 2026, a data broker must access DROP at least once every 45 days, process each deletion request within 45 days, treat an unverifiable request as an opt-out of sale or sharing, pass deletions on to its service providers and contractors, and keep deleting the consumer's data every 45 days afterward.

Legal text (excerpt)

(c) (1) Beginning August 1, 2026, a data broker shall access the accessible deletion mechanism established pursuant to subdivision (a) at least once every 45 days and do all of the following: (A) Within 45 days after receiving a request made pursuant to this section, process all deletion requests made pursuant to this section and delete all personal information related to the consumers making the requests consistent with the requirements of this section. [...] (d) (1) Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall delete all personal information of the consumer at least once every 45 days pursuant to this section unless the consumer requests otherwise or the deletion is not required pursuant to paragraph (2) of subdivision (c).

Primary source