California Delete Act and DROP Guide for Data Brokers

Since 1 August 2026 every registered California data broker must pull consumer deletion requests from a state platform at least every 45 days and delete matching records, and most of the work lands on data engineering and security teams rather than on lawyers. The California Delete Act (SB 362) moved the state's data broker registry to the California Privacy Protection Agency, now branded CalPrivacy, and created the Delete Request and Opt-out Platform (DROP), through which a consumer can send one deletion request to every registered broker. This guide sets out who counts as a data broker, the registration and DROP processing duties in the CalPrivacy regulations, the deadlines and fines, and how to build a matching and deletion pipeline that will survive the audits due from 2028. It is for privacy engineers, data platform owners, CISOs and compliance leads at data brokers, ad tech, people search, marketing data and analytics companies. Status: summarised from CalPrivacy pages and the DROP regulations, checked 27 October 2026.

Key takeaways

The test is the missing direct relationship. A data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom it does not have a direct relationship (Cal. Civ. Code 1798.99.80(c)), and each legal entity must register separately.
Registration is annual and paid. Brokers register with CalPrivacy every January, for a $6,000 fee plus a processing fee of up to 2.99%, and SB 361 added disclosures on sensitive data and sharing with foreign actors, law enforcement and generative AI developers.
DROP processing is a 45-day cycle. From 1 August 2026 brokers must download their selected deletion lists at least every 45 calendar days, match hashed identifiers, delete or opt out matching records, and report a status for every request.
Fines accrue per day and per request. CalPrivacy states $200 a day for failing to register and $200 a day for each deletion request a broker fails to honour, plus investigation costs.
Audits are coming. From 1 January 2028, and every three years after, brokers need an independent audit of their compliance, and from 2029 registration must disclose it, so evidence and logs matter now.

Scope: who and what is covered

The Delete Act sits in the California Civil Code from section 1798.99.80 and is implemented by CalPrivacy regulations in Title 11 of the California Code of Regulations, sections 7600 onwards. It operates alongside, not instead of, the California Consumer Privacy Act (CCPA): a broker still owes CCPA rights to consumers who contact it directly. For the wider US picture see the US State Privacy Laws Guide.

Question	Answer from the official sources	Practical note
Who is a data broker?	A business that knowingly collects and sells to third parties personal information of consumers with whom it has no direct relationship (1798.99.80(c))	Assess each data source: purchased, scraped and partner-supplied data about non-customers is the trigger
Which year counts?	A business registers if it met the definition in the previous calendar year (11 CCR 7602(a), as cited by CalPrivacy)	Run the assessment each December for the following January window
Groups of companies	Each distinct legal entity that qualifies registers separately; a parent's registration does not cover a subsidiary (Enforcement Advisory 2025-01)	Map entities, not brands
Which data must be deleted?	All personal information associated with a matched consumer, including inferences, except exempt data and data collected directly from the consumer in a first-party relationship (11 CCR 7613)	Tag data by source and exemption status at ingestion
What does "delete" mean?	Permanent erasure, deidentification or aggregation; archived or backup copies may be deleted when restored or accessed for a commercial purpose (11 CCR 7613)	Your backup restore process needs a DROP suppression step
Who submits requests?	Consumers through DROP, open to consumers since January 2026	Brokers must not contact consumers to verify DROP requests (11 CCR 7616)

The statute also excludes some entities and data that other laws regulate. Those exclusions are in the Civil Code text, which should be read with counsel before deciding that a business or dataset is out of scope.

Key obligations

Registration

Annual window: register between 1 and 31 January (the 2026 window was 1 to 31 January 2026) through a DROP account. CalPrivacy states account approval usually takes no more than two business days, so do not leave it to the last week.
Fee: $6,000, plus a third-party electronic payment processing fee of up to 2.99%; nonrefundable and not prorated (11 CCR 7600).
Disclosures: business and trade names, contacts, websites and tax identifiers, plus the expanded SB 361 disclosures, including the types of sensitive data collected and whether data is shared with foreign actors, law enforcement or generative AI developers.
Metrics: by 1 July following the first year a business qualifies as a broker, publish on the privacy policy page the number of deletion, access and opt-out requests received and the median and mean response times. CalPrivacy asked brokers to report 2024 metrics when registering in January 2026.

DROP account and access

Secure account (11 CCR 7610): create the account before first access, protect credentials with reasonable security, limit access to authorised persons, and report unauthorised use or a security breach of the account to CalPrivacy immediately.
List selection (7610): select every consumer deletion list whose identifier types match your records, skipping only lists that would produce duplicate results; selections can be changed only once every 45 calendar days.
Access fee (7611): brokers that first access DROP after starting operations pay a fee by month, from $6,000 in January falling by $500 a month to $500 in December, plus a processing fee of up to 2.99%.
Cadence (7612): download selected lists at least once every 45 calendar days, by API or manually. If automated access fails for reasons outside your control, notify CalPrivacy within 45 days of the last access and download manually. After the first download, each download contains only new or amended requests.

Matching, deletion and reporting

Step	Rule (11 CCR)	Engineering implication
Standardise	7613(a): lowercase, remove special characters (non-English characters to nearest English equivalent, email addresses left as is), dates as YYYYMMDD, ZIP codes to five digits, phone numbers to last ten digits	Build a normalisation library and unit test it against CalPrivacy examples
Hash	7613(a): hash with the same algorithm as the list; for combined identifiers hash each separately, combine, and hash again	Never reverse or store plaintext list values; compare hashes only
Delete or opt out	7613: delete all associated PI including inferences; if several consumers match one identifier, opt each out of sale or sharing	Deletion must reach derived tables, models' feature stores and exports
Downstream	7613(d) and (e): direct service providers and contractors to delete, sharing only the minimum needed	Contractual and technical deletion feeds to processors
Unmatched requests	7613(c), 7614: keep unmatched lists and check new data against them before selling or sharing; report later matches at the next session	A suppression check in every ingestion and sale pipeline
Report status	7614: one code per request: record deleted, record opted out of sale, record exempted, record not found; manual uploads as CSV	Status must be computed per transaction ID, not in aggregate
Use limits	7616: DROP data only for compliance, never sold or shared, protected by reasonable security	Segregate DROP data and restrict its access
Exit	7615: on ceasing to be a broker, notify within 45 days and delete DROP data within 30 days after the final registration or audit, whichever is later	Include in decommissioning runbooks

Timeline and current status

Date	Milestone
17 December 2025	CalPrivacy Enforcement Advisory 2025-01 on registration of parents and subsidiaries
1 January 2026	DROP regulations effective (document header); brokers must establish DROP accounts
January 2026	DROP opens to consumers; annual registration window 1 to 31 January 2026, including 2024 metrics
1 August 2026	Brokers must access DROP at least every 45 days and process deletion requests; access fees apply
1 July each year	Publication of request metrics for brokers in their first qualifying year onward
1 January 2028	Independent audits begin, then every three years; reports provided to CalPrivacy on written request
1 January 2029	Registration must disclose whether an audit has occurred and the latest year a report was submitted
27 October 2026	Status check for this guide: DROP live and processing obligations in force

Enforcement and penalties

Failure	Consequence stated by CalPrivacy
Failing to register	Administrative fine of $200 for each day of non-registration, an amount equal to the fees due for the period, and the Agency's investigation and administration expenses (Civ. Code 1798.99.82, cited in Enforcement Advisory 2025-01)
Failing to delete under DROP	$200 per day for each deletion request not honoured, plus investigation and administrative costs
Misusing DROP data or weak account security	Breach of 11 CCR 7610 and 7616, enforceable by CalPrivacy

The per-request, per-day structure is what makes DROP risk scale. A broker that misses one 45-day cycle with tens of thousands of matched requests is exposed to fines that grow daily for every request, which is why the processing pipeline needs monitoring and alerting like any production service. CalPrivacy also maintains a public data broker registry, so non-registration is visible.

What it means for AI agents and non-human identities

The DROP API credential is a regulated secret: the regulations require secure credentials, access limited to authorised persons, and immediate reporting of unauthorised use. Store the API credential in a secrets manager, bind it to one service identity, rotate it, and alert on use from unexpected sources. See the Secrets Management Guide.
Pipelines run as service accounts: the download, matching, deletion and status jobs run under service accounts or workload identities with delete rights across the data estate. Give them narrowly scoped permissions, an owner and full audit logging, because they are both a compliance control and a high-impact identity. See the Service Account Security Guide.
Generative AI sharing is now a disclosure item: SB 361 asks brokers to disclose whether they share data with generative AI developers. Inventory any datasets licensed for model training and any agents or tools that pass broker data to AI providers.
Deletion must reach AI artefacts: inferences are personal information to be deleted under 7613. Check feature stores, embeddings, enrichment caches and agent memory that hold profiles derived from matched consumers.
Agents that buy or ingest data need suppression checks: any automated data acquisition, including AI agents that scrape or enrich records, must check unmatched DROP lists before data is sold or shared.

Compliance steps

Decide status per entity: for each legal entity, list data sources about people with whom it has no direct relationship, and whether it sold such data in the previous year. Record the decision and the evidence.
Register and disclose: open the DROP account early in January, complete the SB 361 disclosures and publish metrics on the privacy policy page.
Build the identity map: identify which identifier types (email, phone, name with date of birth, address and so on) exist in each system so you can select every matching list.
Implement normalisation and hashing: code the 7613 standardisation rules, hash using the list's algorithm, and test with synthetic records. Keep plaintext identifiers out of logs.
Wire deletion through the estate: primary stores, warehouses, derived tables, inference outputs, exports, service providers and contractors. Add a suppression step to backup restores and to every ingestion and sale pipeline.
Report statuses: compute one status per transaction ID each cycle and submit it before the next download.
Operate it like production: schedule downloads well inside 45 days (for example every 30), alert on failed runs, and keep a run log showing download time, counts matched, deleted, opted out, exempted and not found.
Prepare for the 2028 audit: retain evidence of each cycle, access logs for the DROP credential and deletion job identities, and test results for matching accuracy.

Measuring it

Cycle latency: days between DROP downloads; target well under 45, alert above 35.
Status completeness: percentage of transaction IDs with a reported status each cycle; target 100%.
Deletion reach: percentage of systems holding consumer data that confirm deletion for a sample of matched requests.
Suppression hits: count of records blocked at ingestion or sale by unmatched list checks, trended over time.
Credential hygiene: age of the DROP API credential and number of identities with access to it.

Framework mapping

Delete Act duty	NIST CSF 2.0	NIST SP 800-53 Rev 5	ISO/IEC 27001:2022 Annex A
Knowing registration and deletion duties	GV.OC-03	PT-2, PT-3	5.31 Legal, statutory, regulatory and contractual requirements
Deletion of personal information	PR.DS-01	SI-12 Information Management and Retention	8.10 Information deletion, 5.34 Privacy and protection of PII
Securing the DROP credential and job identities	PR.AA-01	IA-5, AC-6	5.17 Authentication information, 8.2 Privileged access rights
Directing service providers to delete	GV.SC-05	SR-6	5.20 Addressing information security within supplier agreements
Evidence for audits	DE.CM-01	AU-11	8.15 Logging

Common failure patterns

Relying on the parent's registration: CalPrivacy's advisory is explicit that each qualifying legal entity registers separately.
Selecting too few lists: choosing only email lists when phone numbers and addresses are also held leaves matches unprocessed in breach of 7610.
Deleting the profile but not the inferences: segments, scores and model outputs survive in downstream tables.
Backups that resurrect records: a restore puts deleted consumers back into the sale pipeline because suppression was not applied.
A shared, unrotated API key: the DROP credential is copied into scripts and laptops, so unauthorised use cannot be ruled out or reported.
Missing a cycle quietly: a failed scheduled job goes unnoticed past 45 days, and per-request daily fines accrue.

Practitioner checklist

Each legal entity has a documented data broker determination for the previous calendar year.
Registration, SB 361 disclosures and request metrics are complete and published.
Every identifier type you hold is mapped to a DROP list selection.
Normalisation and hashing follow 11 CCR 7613 and are tested.
Deletion reaches inferences, derived data, exports, backups on restore and service providers.
Unmatched lists are checked before any sale or sharing.
Status codes are reported for every transaction ID each cycle.
The DROP credential is vaulted, scoped to one identity, rotated and monitored.
Download jobs run well inside 45 days with alerting on failure.
Evidence is retained for the independent audit from 2028.

Standards and references

Related NHI Mgmt Group resources: US State Privacy Laws Guide · Secrets Management Guide · Service Account Security Guide · Massachusetts 201 CMR 17.00 Guide. This guide summarises the California Delete Act and CalPrivacy data broker regulations and is not legal advice.

California Delete Act and Data Broker Registration Guide: DROP Deletion Duties, Deadlines and Penalties