The California Delete Act is the law that gave consumers one place to ask every registered data broker to delete their personal information at once. Before it, a consumer who wanted to be removed from hundreds of broker databases had to find each broker and file a separate request. The Delete Act moved that burden onto the brokers: the state runs a single platform, consumers submit once, and every registered broker is required to come and read the list.
That platform is DROP, the Delete Request and Opt-out Platform, operated by the California Privacy Protection Agency. If your business is registered as a California data broker, DROP is now part of your operating calendar, not an occasional legal matter.
What the law actually is
The Delete Act was enacted as SB 362 and sits in the California Civil Code at section 1798.99.80 and following. It builds on the earlier data broker registration statute rather than replacing it. Registration was already a duty. What SB 362 added is the deletion mechanism: a state-run request platform, a duty to access it on a schedule, and a duty to act on what you find there.
It is worth separating two things people often merge. The CCPA gives consumers rights against businesses they deal with directly. The Delete Act is aimed specifically at businesses consumers have no relationship with, and cannot easily find. That is why the state built a central platform instead of writing another notice requirement.
Who the Delete Act binds
It binds data brokers as California defines them: a business that knowingly collects and sells personal information about consumers with whom it does not have a direct relationship. All three parts have to be true at once. A business that sells personal information about its own customers is not a data broker under this definition. A business that collects third-party data and never sells it is not one either.
- You collect personal information about California consumers.
- You sell it, meaning you disclose it to another business or third party for monetary or other valuable consideration.
- The consumers in question are people you have no direct relationship with.
If that describes you, registration is not optional and the DROP duties follow from it. If you are not sure, work through the definition before you register, because registering commits you to a recurring operational cycle. Our data broker check walks the same three parts.
The obligations, in order
| Obligation | Cadence | Where it happens |
|---|---|---|
| Register with the state and pay the annual fee | Every year by January 31 | The Data Broker Portal |
| Answer the registration disclosure questions | At each registration | The Data Broker Portal |
| Select your consumer deletion lists and issue an API key | Once, then whenever your list selection changes | The Data Broker Portal, API Key tab |
| Access DROP and process deletion requests | At least once every 45 days | The DROP API |
| Record a status for every matched record | Each cycle | A status file uploaded to DROP |
| Keep a record of what you did and when | Continuous | Your own systems |
The dates that matter
- January 2026
- Consumers can submit deletion requests through DROP
- January 31
- Annual data broker registration deadline
- March 2026
- DROP sandbox environment available to brokers
- August 1, 2026
- Brokers must begin processing DROP requests
- Then
- Access DROP at least once every 45 days
- Registration fee
- $6,000 plus a processing fee, paid to the state
The 45-day clock is the part that changes how a company works. It is not an annual filing you can hand to outside counsel once and forget. It is a recurring operational cycle with a hard interval, and every interval produces a record that either exists or does not.
What a cycle looks like
- 01Pull the current deletion list from DROP using your API key.
- 02Standardize and hash your own records the way the technical specification defines, so you never send raw identifiers.
- 03Match your hashes against the list you pulled.
- 04Decide, for each match, whether the record is deleted or covered by a lawful exemption.
- 05Build the status file, one row per matched identifier, and upload it to DROP.
- 06Keep the confirmation, the counts, and the timestamps.
Two details in that sequence are easy to get wrong. The first is hashing: matching is done on hashed identifiers, and a normalization mistake produces a silent false negative, which means a consumer who asked to be deleted is never found. The second is the deleted-versus-exempted decision. A hash match tells you a record is on the list. It does not tell you whether you are entitled to keep it. That determination belongs to the business and its counsel, and it should be recorded with a reason.
Submitted is not filed
When you upload a status file, DROP accepts it for validation. Acceptance is a queue receipt, not a confirmation that every row passed. Record-level validation results come back afterward, and they can come back with errors that need correcting. Treating the upload response as the end of the cycle is how a broker ends up believing a cycle closed when it did not. Track the two states separately and keep the evidence for both. See submitted versus filed for the distinction in detail.
Enforcement and the penalty
The California Privacy Protection Agency administers the registry and enforces the registration duty. Failure to register carries an administrative fine of up to $200 per day under Cal. Civ. Code section 1798.99.82, along with the fees that were not paid and the agency's costs. The figure is a statutory ceiling, not a prediction of what any particular matter would cost, and the agency has published enforcement decisions against brokers that did not register on time.
A missed cycle and a missed registration are different failures with different exposure. Do not let a clean registration record convince you the deletion cycle is being run.
Where to read the primary sources
- The bill text and history: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB362
- The agency: https://cppa.ca.gov/
- DROP for data brokers, including the dates above: https://privacy.ca.gov/drop-for-data-brokers/
- The technical specification brokers build against: https://privacy.ca.gov/drop-for-data-brokers/technical-specifications/reference/
- The public registry of registered brokers: https://cppa.ca.gov/data_broker_registry/
DropDue is software that helps you run and record the cycle. It does not file your registration and it does not make the deletion or exemption call for you. You confirm every determination before anything is submitted, and the record of who confirmed what, and when, is the point.