On August 1, 2026, the California Privacy Protection Agency's Delete Request and Opt-Out Platform (DROP) went live. Created under the Delete Act, DROP gives California consumers a single mechanism to direct every registered data broker in the state to delete their personal information through a single request.

For data brokers, compliance obligations now extend beyond registration. Data Brokers must access the platform, compare consumer requests against their records, and within 45 days either delete the matching personal information, opt the consumer out, or determine that no matching record exists. Brokers must then continue checking DROP at least once every 45 days on an ongoing basis.

Where CalPrivacy Has Focused Enforcement So Far

Failure to register. Businesses that meet California's definition of a data broker must register annually with the Agency. Failure to register can result in administrative fines of $200 per day for each day the business remains unregistered. To date, failure-to-register actions have been among the most common forms of Delete Act enforcement.

Inaccurate registration filings. As reported by Privacy Daily, CalPrivacy recently assessed a $12,200 administrative fine against WINR Data and two separate $10,800 fines against Clarivate and Decision Resources, all for incorrectly reporting that they sold or shared personal information with foreign actors during 2025. These fines stem from a new registration requirement added by SB 361 requiring data brokers to disclose whether they sold or shared personal information with certain foreign actors. For a more detailed discussion of this requirement, see our previous blog post here.

Where Future Enforcement Risk May Emerge

Failure to process deletion requests. Beginning August 1, 2026, a data broker that fails to process a deletion request may be subject to a fine of $200 per deletion request, per day, for as long as the personal information remains undeleted. Because these penalties are assessed on a per request and per day basis, the potential exposure could far exceed prior fines seen by CalPrivacy. With 345,000 consumers already signed up for DROP, a 30-day failure to comply could result in penalties exceeding 10 million dollars. 

Looking Ahead

CalPrivacy is expected to discuss additional DROP statistics at its August 7 Board meeting. The Board is also scheduled to consider potential next steps regarding data broker DROP compliance audits, including whether to advance proposed audit regulations into the formal rulemaking process. The proposed regulations would also formalize requirements relating to data broker "suppression lists," which are intended to help ensure that consumers who submit DROP requests remain opted out on an ongoing basis. We will be monitoring these developments closely and will provide a follow-up update after the meeting.

Regardless of any future rulemaking, data brokers that have not yet operationalized their intake, matching, deletion, and ongoing monitoring processes for DROP should do so immediately.