California's DROP Act Kicks Off August 1: Delete Request Automation

Imagine a California resident frustrated with their personal data circulating endlessly across data brokers—profiles built from online shopping habits, browsing history, and inferred interests. With a single request through the state's new Delete Request and Opt-Out Platform (DROP), they can demand deletion from hundreds of brokers at once. Starting August 1, 2026, data brokers must automate this process every 45 days or face steep penalties, reshaping how businesses handle consumer data.¹ ²

This isn't just a California issue. If your website serves California users and involves data collection, sharing, or sales—even indirectly—you could be affected. The Delete Act (SB 362), signed in October 2023, mandates this centralized system to empower consumers while imposing strict operational requirements on data brokers.³ ² With DROP live for consumer requests since January 1, 2026, and processing obligations kicking in soon, now's the time to assess compliance.⁴ ⁵

What Is the Delete Act and DROP?

The Delete Act builds on California's 2019 data broker registry by introducing DROP, a first-of-its-kind platform administered by the California Privacy Protection Agency (CalPrivacy). It allows consumers to submit one verifiable request to delete their personal information from all registered data brokers, plus opt out of future sales or sharing.¹ ⁶ ⁷

Key timelines:

January 2024 onward: Annual data broker registration with CalPrivacy, including fees to fund the registry and DROP.⁶ ³
January 1, 2026: DROP opens for consumer submissions; data brokers create accounts and complete registration by January 31.⁴ ⁵ ²
Spring 2026: API integration available for automated access.⁴
August 1, 2026: Data brokers must retrieve and process requests every 45 days.¹ ⁴ ⁵
January 2028: Triennial independent audits begin.³

DROP uses standardized identifiers and a specified hashing algorithm for matching requests to records, ensuring precise deletions.¹ ⁴ Regulations finalized in 2026 require data brokers to direct service providers, contractors, and affiliates to delete data too.¹

This echoes broader privacy trends, like CCPA's right to deletion (Civil Code § 1798.105), but scales it via automation for data brokers.¹

Who Counts as a Data Broker?

California defines a data broker broadly: any entity that "knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship."⁴ ⁵ This includes aggregators, enrichers, and resellers of data gathered outside direct consumer interactions, such as from public sources or third-party purchases.⁴ ⁷

Websites or apps that sell or share user data for profiling, advertising, or enrichment—even if not your core business—may qualify.⁴ ⁵
Exemptions apply to public government data, FCRA-covered credit reporting, HIPAA health data, and businesses already compliant under those laws.⁷
If you share data downstream (e.g., with analytics vendors), check if that triggers broker status.⁴

Website owners: Traffic from California users doesn't automatically make you a broker, but if you handle personal info (e.g., emails, IPs, behavior data) and sell/share it, register now. Non-California businesses are in scope if they target or process California data.⁴ ⁵

Core Compliance Requirements Starting August 1, 2026

From August 1, data brokers must check DROP at least every 45 days via the CalPrivacy website or API.¹ ⁴ ⁵ Here's the step-by-step process:

Account Setup: Register a secure DROP account, select relevant consumer deletion lists (avoiding duplicates), and maintain access controls. Notify CalPrivacy immediately of breaches.¹
Retrieve Requests: Download lists matching your data identifiers (e.g., hashed emails, names).¹ ⁴
Match and Delete: Use standardized hashing to confirm matches. Delete all associated personal information, including inferences, from your systems, service providers, and contractors. Direct them to comply.¹ ⁴ ⁵
Timeline: Finalize within 90 days of retrieval. No contacting consumers for verification—prohibited under Section 7616.¹ ⁵
Record-Keeping: Document determinations, maintain suppression lists, and retain records. Report status back via DROP.⁴ ⁵
Ongoing: Update account details, delete DROP-provided data if exiting broker status (within 30 days post-registration/audit), and deactivate account.¹

Automation is key: Manual checks risk missing the 45-day cycle. API integration, available since spring 2026, enables programmatic pulls, matching, and propagation.⁴

Penalties are severe: $200 per missed request per day. A single overlooked request could snowball quickly.¹

Vendor Propagation: The Hidden Challenge for Websites

Data brokers often rely on vendors for storage, analytics, or marketing. DROP requires propagating deletions to all service providers and contractors holding the data.¹ ⁴ This mirrors GDPR's processor obligations (Article 28) and CCPA's service provider rules (Civil Code § 1798.140(v)).¹

Practical tips for compliance:

Map Your Ecosystem: Inventory all vendors touching California personal data. Classify as service providers (limited use) vs. those enabling sales/sharing.⁴
Contract Updates: Amend agreements to mandate DROP compliance, automated deletion APIs, and audit rights. Include indemnity for penalties.¹
Technical Implementation:
- Integrate DROP API for request ingestion.
- Build internal deletion workflows: Hash matching → Data scan → Propagation via vendor APIs.
- Use suppression lists to block re-acquisition.
Testing: Leverage CalPrivacy's sandbox for API trials before August 1.⁵
Exceptions: Don't delete if data is public government info or exempt under other laws (e.g., financial records).⁷

For websites: If you're not a broker but use data brokers (e.g., for ad targeting), ensure your contracts require DROP compliance to avoid indirect liability.

Actionable Steps for Website Owners and Businesses

With six months until enforcement (as of February 2026), prioritize these:

Self-Assess (Now): Review data flows against Delete Act definitions. Use CalPrivacy's registry to check peers.⁵ ²
Register if Needed (January 2026): Annual fee-based process; include enhanced disclosures per SB 361 amendments.⁶ ²

Build Automation:

Step	Action	Timeline
1. Account Creation	Via CalPrivacy site	Jan 1-31, 2026⁴
2. API Setup	Integrate sandbox	Spring 2026⁴ ⁵
3. Deletion Pipeline	Hash, scan, propagate	Test by July 2026
4. First Check	Retrieve/process	Aug 1, 2026¹

Audit Prep: Plan for 2028 audits; document everything.³
Train Teams: Educate legal, engineering, and ops on prohibitions (e.g., no consumer contacts).¹
Monitor Updates: Regulations evolved from 2024 proposals; watch CalPrivacy for clarifications.³ ²

Compare to other laws:

Law	Deletion Mechanism	Frequency/Automation
CCPA §1798.105	Individual requests	45-90 days, manual¹
GDPR Art. 17	Right to erasure	Prompt, processor propagation
DROP (Delete Act)	Centralized, automated	Every 45 days¹ ⁴

This automation reduces consumer friction but demands robust tech stacks.

Potential Challenges and Risks

Scale: High-volume brokers face thousands of requests; manual processes won't scale.⁴
Matching Accuracy: Hashing errors could lead to over- or under-deletion, inviting fines or lawsuits.¹
Vendor Resistance: Non-compliant partners expose you to liability.¹
Enforcement: CPPA's recent actions signal aggressive oversight; audits start 2028.⁶ ³

Businesses exiting broker status must notify within 45 days and purge data.¹

Key Takeaways

August 1, 2026, is go-live: Automate 45-day DROP checks or risk $200/day per request fines.¹ ⁵
Broad Scope: Any California-data seller/sharer may qualify as a broker—assess now.⁴ ⁵
Automation Wins: API integration and vendor propagation are non-negotiable for efficiency.⁴
Plan Ahead: Self-audit, update contracts, test pipelines, and document for audits.⁵
Consumer Power: DROP simplifies deletions, aligning with CCPA/GDPR but uniquely centralized.⁷ ²

Compliance isn't optional—it's a competitive edge in privacy-first California. Stay vigilant as CalPrivacy refines implementation.¹ ²

California's DROP Act Kicks Off August 1: Delete Request Automation