California Delete ActCalifornia Delete ActCoverage from Governor of California, Privacy and Data Security Insights, and others
00/00/0000
DailyWeekly
California’s Delete Act establishes a statewide framework for regulating data brokers and giving residents a centralized way to request deletion of their personal information.
Through the California Privacy Protection Agency’s Delete Request and Opt-Out Platform, or DROP, one verified request can reach participating registered brokers, which must retrieve requests on a recurring schedule, delete covered data, stop subsequent sales or sharing, and report results. The regime also covers broker registration, disclosures, audits, and penalties, with implementation questions focusing on compliance, verification, unregistered brokers, and the handling of sensitive data.
Its reported response and deadline figures show how broker practices can leave deletion requests unresolved in practice.
Cybernoz
Key Issues
01
Centralized deletion is operational
DROP lets residents submit one request to registered brokers instead of contacting them separately. Brokers must check the platform on a recurring cycle, process covered requests, and report status; statutory deadlines govern completion.
Drawn from 4 articles
02
Broker duties face active enforcement
CalPrivacy has imposed penalties for registration failures and conduct that obstructed consumer opt-outs, including actions under both the Delete Act and CCPA. These cases make administrative enforcement a current compliance risk alongside statutory daily penalties.
Drawn from 4 articles
03
Coverage and outcomes remain incomplete
DROP applies to registered brokers and remains subject to statutory exclusions, leaving some businesses and records outside the system. Reports of unanswered requests, missed deadlines, and obstructive verification practices also show that submitting a centralized request does not guarantee deletion or a clear outcome.
Drawn from 4 articles
Key Numbers
$52,400 USD
penalty against Cybba
for failure to register as a data broker · August 13, 2026
“Days later, it announced a second action against Cybba, Inc., imposing a $52,400 fine for failing to register as a data broker.”
Paul Weiss and 1 other article
$116,490 USD
total penalty against LocateSmarter
Delete Act and CCPA violations
“The California Privacy Protection Agency (CalPrivacy) announced its first enforcement action against a data broker under the California Consumer Privacy Act (CCPA), fining Iowa-based LocateSmarter LLC $116,490.”
Lexology
$30,600 USD
Delete Act penalty
LocateSmarter stipulated final order
“The stipulated final order requires LocateSmarter to pay $30,600 for the Delete Act violation and $79,890 for the CCPA violations. It must register as a data broker, disclose metrics about CCPA requests, process deletion requests submitted through DROP, and make its opt-out process easy and minimally burdensome.”
Lexology
$79,890 USD
CCPA penalty
LocateSmarter stipulated final order
“The stipulated final order requires LocateSmarter to pay $30,600 for the Delete Act violation and $79,890 for the CCPA violations. It must register as a data broker, disclose metrics about CCPA requests, process deletion requests submitted through DROP, and make its opt-out process easy and minimally burdensome.”
Lexology
$1 million per year
New Jersey data-broker registration fee
exceeding
“New Jersey’s fees can be substantial: brokers selling or licensing data on more than 2.5 million New Jersey consumers face an annual fee exceeding $1 million.”
Privacy and Data Security Insights
Looking Back
1102 Day Timeline
Articles published over time. Hover any bar for the period and its article count.
New state requirements add registration costs, risk-assessment certifications, audits, and a surety-bond obligation to the compliance landscape around data brokers. California’s DROP remains the topic’s central mechanism, but the added requirements show that broker regulation extends beyond processing centralized deletion requests.
Previously
California’s Delete Request and Opt-Out Platform (DROP) lets residents submit a single request to registered data brokers, which must retrieve requests regularly and process them under the Delete Act. The system centralizes a process that previously required contacting brokers individually, while daily penalties and ongoing deletion duties give the requirements practical force. Separate legislation, SB 923, expands some CCPA deletion rights but does not operate through DROP.
History
10/03/2026
The update adds that brokers must report request status and clarifies that DROP’s coverage is limited by statutory exemptions and scope rules.
10/01/2026
The story now includes SB 923, a separate 2027 expansion of some CCPA deletion rights that does not operate through DROP. The current version also specifies a general 90-day processing deadline for covered DROP requests.
California's Privacy Protection Agency fined LocateSmarter in California's first Delete Act-era data-broker action for obstructing opt-outs and failing to register.
8/13/2026 • Regulation, Law & Enforcement • General
Privacy and Data Security Insights / Michael Young71
As state data-broker laws expand, companies selling personal data about people without direct relationships face registration, deletion, security, and audit duties in California, New Jersey, Oregon, Texas, Vermont, and Connecticut.
10/13/2026 • Regulation, Law & Enforcement • General
Paul Weiss / John P. Carlin, David K. Kessler, Ian C. Richardson, Jacobus "Janus" Schutte, Audrey M. Paquet, Maggie Lu, Michael Shepard71
The California Privacy Protection Agency fined LocateSmarter and Cybba in California during August 2026 for data broker registration and consumer privacy violations.
9/9/2026 • Regulation, Law & Enforcement • General
Lexology / John P. Carlin, David Kessler, Ian C. Richardson, Jacobus "Janus" Schutte, Audrey M. Paquet, Maggie Lu, Michael Shepard71
California's privacy regulator fined LocateSmarter and Cybba in 2026 for data-broker registration failures and practices obstructing consumer deletion and opt-out rights.
9/9/2026 • Regulation, Law & Enforcement • General
The California Privacy Protection Agency ordered Iowa-based LocateSmarter LLC to pay $116,490 in 2026 for registration and opt-out violations involving California consumers.
8/12/2026 • Regulation, Law & Enforcement • General
California residents began using the California Delete Request and Opt-Out Platform in January 2026 to direct registered data brokers statewide to delete personal information.
8/4/2026 • Regulation, Law & Enforcement • General
Privacy and Data Security Insights / Kennedy Brooks71
California, New Jersey, Connecticut, Vermont, and federal regulators expanded data broker privacy obligations during 2026 through registration, deletion, breach, and foreign-adversary data sale controls.
8/4/2026 • Regulation, Law & Enforcement • General
California's privacy system began requiring registered data brokers to process centralized consumer deletion requests on August 1 through the statewide DROP platform.
8/3/2026 • Regulation, Law & Enforcement • General
California’s Delete Act takes effect August 1, requiring data brokers to delete records tied to DROP deletion requests submitted by California residents.
7/20/2026 • Regulation, Law & Enforcement • General
California’s Delete Act takes effect on Aug. 1, requiring data brokers to delete residents’ personal data, enforced by the California Privacy Protection Agency and the state attorney general.
7/16/2026 • Regulation, Law & Enforcement • General
California data brokers must begin Aug. 1 deletion processing via DROP under CalPrivacy requirements, converting broker deletion into recurring 45-day workflows with 2028 audits.
7/3/2026 • Regulation, Law & Enforcement • General
The California Privacy Protection Agency Board, meeting May 1, 2026, outlined expanded enforcement against data brokers and privacy-rights failures, with future DELETE Act deletion obligations.
5/20/2026 • Regulation, Law & Enforcement • General
California will begin imposing daily penalties on noncompliant data brokers in August for delayed deletion requests and inadequate explanations of denials.
8/4/2026 • Regulation, Law & Enforcement • General
California Privacy Protection Agency launches the Delete Request and Opt-out Platform to centralize deletion requests from data brokers registered in California on January 1, 2026.
3/5/2026 • Regulation, Law & Enforcement • General
CalPrivacy Executive Director Tom Kemp detailed in California how the DROP deletion platform, new audit division, and phased risk assessments will reinforce CCPA enforcement against data brokers and businesses starting in 2026.
1/1/2026 • Regulation, Law & Enforcement • General
The California Privacy Protection Agency on November 8 approved regulations expanding the data broker definition and raising registration fees to fund a statewide deletion and opt-out platform in California.
11/19/2024 • Regulation, Law & Enforcement • General
Wilson Sonsini Goodrich & Rosati Professional Corporation Home Page - Palo Alto / Tracy Shapiro65
The California Privacy Protection Agency adopted Delete Act broker regulations on Nov. 8, 2024, in Sacramento, expanding broker definitions, increasing fees, and mandating a state opt-out deletion platform.
1/1/1900 • Regulation, Law & Enforcement • General
Alex Schneider, Aaron Burstein, and Celine Guillou discussed expanding New Jersey and California data broker obligations for businesses operating across state data flows.
8/3/2026 • Regulation, Law & Enforcement • General
The California Privacy Protection Agency ordered data broker Background Alert to shut down for three years in 2024 after noncompliance with California Delete Act registration requirements.
2/28/2025 • Regulation, Law & Enforcement • General
California launched DROP in 2026, allowing California residents to send centralized deletion and opt-out requests to registered data brokers statewide.
8/3/2026 • Consumer Privacy & Digital Rights • General
California Privacy Protection Agency administers DROP, a centralized system requiring registered data brokers to process deletion requests starting Aug. 1, 2026.
5/4/2026 • Consumer Privacy & Digital Rights • General
On May 1, 2026, California Privacy Protection Agency Board reviewed expanded enforcement plans centered on data brokers, statutory deletion and opt-out rights, and future DELETE Act global deletion integration.
5/19/2026 • Regulation, Law & Enforcement • General
California data brokers denied or ignored more than one million deletion requests, prompting state enforcement through the DROP platform beginning August 1.
7/31/2026 • Consumer Privacy & Digital Rights • General
California's SB 362 will require registered data brokers to delete sensitive personal data through the DROP system starting after August 1, with $200-per-day penalties for failures.
7/13/2026 • Consumer Privacy & Digital Rights • General
California launched the DROP platform on August 1, 2026, enabling California consumers to send centralized deletion requests to data brokers under recurring state oversight.
8/5/2026 • Regulation, Law & Enforcement • General
CalPrivacy signaled intensified data broker delete-right and registration enforcement on 1 May while opposing the SECURE Data Act and evaluating EU adequacy prospects.
5/4/2026 • Regulation, Law & Enforcement • General
CalPrivacy Director Tom Kemp announced California's DROP deletion platform and new audit division on behalf of the California agency in 2026 to enforce CCPA compliance across the state.
1/1/2026 • Regulation, Law & Enforcement • General
On August 1, 2026, the California Privacy Protection Agency launched DROP in California to centralize consumer deletion and opt-out requests for registered data brokers.
8/10/2026 • Regulation, Law & Enforcement • General
California lawmakers proposed AB 1542 and SB 1106 to restrict sensitive-data sharing and accelerate data-broker deletion processing under CPPA enforcement.
5/12/2026 • Regulation, Law & Enforcement • General
Cory Doctorow criticizes California DROP for data-broker deletion requests that rely on extensive identity verification through Login.gov and related steps.
7/23/2026 • Consumer Privacy & Digital Rights • General
A 2026 privacy assessment found that California data brokers obstruct consumer rights requests and fail to meet disclosure obligations under state law.
8/11/2026 • Corporate Data Practices & Accountability • General
The California Privacy Protection Agency opened DROP to California residents on January 1, 2026, enabling requests to delete personal information held by registered data brokers.
10/23/2026 • Consumer Privacy & Digital Rights • General
AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
