California data brokers must process DROP deletion requests

On August 1, 2026, California data brokers became required to begin processing consumer deletion requests through the Delete Request and Opt-out Platform (DROP), operated by the California Privacy Protection Agency (CalPrivacy). DROP is the accessible deletion mechanism required by the Delete Act. Consumers have been able to submit requests since January 2026; August 1 is when brokers must start retrieving and acting on those lists.

This is separate from CalPrivacy’s first CCPA sectoral audit of gig platforms. DROP duties apply to businesses that meet the Delete Act definition of a data broker, not only to platforms under that audit.

What changed

Under the Delete Act and CalPrivacy’s implementing regulations, data brokers must:

• Maintain a DROP account (and complete annual registration when they operated as a broker in the prior year)
• Access DROP at least once every 45 calendar days to download consumer deletion lists
• Standardize and hash their own records, match them to hashed DROP identifiers, and delete matching personal information (subject to limited exemptions)
• Direct service providers and contractors that hold related personal information to take the required action
• Report the status of each request back through DROP within 45 days of download

CalPrivacy’s broker guidance states that failure to delete as required can bring administrative fines of $200 per day per deletion request, plus investigation costs. Failure to register can bring $200 per day plus costs.

CCPA obligations for businesses that are not data brokers do not change because of this go-live date. Brokers that also have CCPA duties still must honor those rights through their normal channels.

What to do now

1. Confirm whether your organization (or a vendor you use) meets the Delete Act “data broker” definition and is listed in the Data Broker Registry.
2. If you are a broker, create or finish your DROP account, pay any required access or registration fees, and complete your first deletion-list download cycle.
3. Build a repeatable 45-day workflow: download, hash and match, delete or exempt with documentation, report status, and instruct service providers.
4. Treat the first 45-day window from August 1, 2026 as your initial compliance clock, not a soft launch.
5. See the CCPA / CPRA page for how data brokers fit into the law, and follow CCPA on this site for further CalPrivacy Delete Act and CCPA updates.