Privacy ComplianceData Subject Requests
California's DROP Has 550,000 Sign-Ups. Is Your Business a Data Broker?
More than 550,000 Californians have signed up for the Delete Request and Opt-out Platform (DROP), which sends a single deletion request to every registered data broker. Data brokers have been required to process these requests since August 1, 2026. Notably, California's definition of a data broker is broader than many businesses assume.
By Alex Proctor
Published October 7, 2026
Summary
Businesses can qualify as data brokers by selling personal information that they did not collect directly from consumers, or by selling information about customers who have not interacted with them in three years. Data brokers have to check DROP at least once every 45 days and delete the records that match. CalPrivacy, the state's privacy agency, reports that 99 percent of consumers who used DROP had their information deleted by at least one data broker. I recommend that businesses that sell personal information confirm whether they meet the definition, because unregistered data brokers can be fined $200 per day.
What Is DROP?
DROP is California's system for facilitating consumer deletion and opt-out requests. CalPrivacy built it to satisfy the requirements of the Delete Act, which was signed into law in 2023. It serves as a unified channel for requests that would otherwise need to be delivered to more than 650 registered data brokers individually. The platform became available to consumers on January 1, 2026.
Consumers first verify that they are California residents, and then submit identifiers such as their names, email addresses, and phone numbers. According to CalPrivacy, the platform does not store these identifiers in a readable form. It converts them into scrambled codes through a process known as hashing. Data brokers convert their own records the same way, compare the two sets of codes, and then delete the records where the codes match.
DROP covers deletion and opt-out requests exclusively. It does not address other California privacy rights such as access, correction, or portability.
What Do Data Brokers Have to Do?
The requirements appear in Civil Code sections 1798.99.82 and 1798.99.86:
| Requirement | Timing |
|---|---|
| Register with CalPrivacy and pay a fee | By January 31 each year |
| Access DROP to retrieve deletion requests | At least once every 45 days |
| Delete the personal information of matching consumers | Within 45 days of receipt |
| Process unverifiable requests as sale and sharing opt-outs | Within 45 days of receipt |
| Report the status of each request to DROP | Within 45 days of download |
| Screen new records against past deletion requests | Before any sale or sharing |
| Delete new data about the same consumers | At least once every 45 days |
| Complete an independent compliance audit | Every three years, from 2028 |
Based on the Delete Act and CalPrivacy guidance, as of October 2026.
Unlike an ordinary deletion request, a DROP request applies on an ongoing basis. CalPrivacy's guidance says data brokers should maintain a list of the consumers who submitted requests, often called a suppression list, so that new records can be screened against it.
What Do CalPrivacy's Numbers Show?
CalPrivacy published updated figures on October 6, 2026. Since deletion processing began on August 1, 99 percent of consumers who used DROP had their information deleted by at least one data broker. In addition, 70 percent had their information deleted by 100 or more data brokers.
However, a deletion request does not always result in a deletion. Data brokers report a status for each request, such as "deleted," "exempt," or "record not found." According to CalPrivacy, exempt information commonly includes information that consumers provided to the data broker directly and information that is publicly available. The exact boundaries of what must be deleted and what can be retained remain somewhat ambiguous, and they may be subject to further guidance or litigation.
Which Businesses Count as Data Brokers?
The Delete Act defines a data broker as a business that "knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." Businesses are excluded to the extent that they are covered by certain laws on credit reporting, financial privacy, and health privacy.
CalPrivacy's regulations define a direct relationship narrowly. It exists only when a consumer has intentionally interacted with the business within the past three years. The regulations also state that a business "is still a data broker if it has a direct relationship with a consumer but also sells personal information about the consumer that the business did not collect directly from the consumer."
As a result, the definition may apply to businesses that do not think of themselves as data brokers. California's definition of a sale is broad, and it does not require an exchange of money. For example, businesses that buy data about their customers from other sources and pass it to advertising partners may qualify. The same may be true of businesses that continue to sell information about customers who have been inactive for three years.
What Does Enforcement Look Like?
Enforcement belongs to CalPrivacy, and it is administrative. There is no private right of action under the Delete Act. The fine structure penalizes companies $200 per day for registration failures, and $200 per day for each unprocessed deletion request, plus the cost of CalPrivacy's investigation.
CalPrivacy's Data Broker Enforcement Strike Force has already brought actions against unregistered data brokers. In January 2026, Datamasters paid $45,000 and was ordered to stop selling the personal information of Californians entirely. S&P Global paid $62,600 over a registration lapse that was attributed to an administrative error. I expect enforcement to turn to misprocessed DROP requests now that deletion processing has begun.
What Does This Mean for Businesses?
I recommend that businesses that sell personal information review the data broker definition with counsel. DROP only applies to data brokers. However, businesses that meet the definition without realizing it may be accruing penalties for each day that they are unregistered. The next registration deadline is January 31, 2027.
Businesses that are not data brokers still have to honor the deletion requests that consumers send to them directly, without unnecessary friction. Starting January 1, 2027, California's right to delete will also cover personal information obtained from third parties. Consumer privacy rights have tended to expand over time, and I expect that to continue.
Questions
Do data brokers outside California have to comply?+
Yes, if they sell the personal information of California consumers and otherwise meet the definition. The location of the business does not change the requirement. Both of the companies in CalPrivacy's January 2026 actions are based outside California. Datamasters is based in Texas, and S&P Global is based in New York.
Does DROP affect the service providers that data brokers use?+
Yes. Data brokers have to direct their service providers and contractors to delete the personal information of consumers who submitted requests. Vendors that process data for data brokers should be prepared to receive these instructions on the same 45-day cycle.
What does the audit requirement involve?+
Beginning January 1, 2028, data brokers have to undergo an audit by an independent third party every three years to determine whether they comply with the Delete Act's deletion requirements. They have to provide the audit report to CalPrivacy within five business days of a written request. They also have to keep the report and related materials for at least six years.
Briefings are informational and do not constitute legal advice.
Can visitors exercise their rights?
I'll test your request process the way a regulator would.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.