The California Delete Act and Data Brokers
The Delete Act is the statutory source of the DROP obligation. Understanding the structure helps separate legal requirements from implementation choices.
Structure
The Delete Act established data broker registration with the California Privacy Protection Agency and directed the creation of an accessible deletion mechanism. DROP is that mechanism: one consumer request, distributed to registered brokers, processed on a recurring cadence.
Data brokers that meet California's statutory definition must register with the California Privacy Protection Agency and, from August 1, 2026, access DROP at least once every 45 calendar days to process deletion requests.
Separating layers
- Statutory requirements — set by the Delete Act and related California law.
- Regulatory detail — set by CPPA regulations and official technical documentation.
- Implementation choices — how your team builds matching, suppression, and reporting.
Whether your organization meets the data broker definition, and how enforcement provisions apply to your circumstances, should be confirmed with qualified counsel.
This page describes CA DROP Broker's operational reading of publicly available California materials. Verify current requirements against official CalPrivacy sources and with qualified counsel.