Beginning August 1, 2026, California data brokers must download, match, process, and report DROP deletion requests on a recurring 45-calendar-day cycle.
This workflow separates the binding Delete Act and DROP regulations from CalPrivacy's implementation guidance, and records list selection, hashing, outcomes, downstream instructions, and ongoing suppression.
Structured answer sets in this page tree.
Cited legal and guidance references.
A is a CCPA business that knowingly collects and sells to third parties personal information of consumers with whom it has no direct relationship, subject to statutory exclusions. Beginning August 1, 2026, a data broker must access DROP at least once every 45 calendar days, download every applicable consumer list, standardize and hash its own identifiers, process matches and nonmatches, report each status within 45 days of download, and repeat the cycle. This is a Delete Act workflow, not the ordinary CCPA deletion-request process for every business.
Decide scope for each legal entity. Under the registration regulations, a direct relationship means that the consumer intentionally interacted with the business to obtain, access, buy, use, or request its products or services within the preceding three years. A rights request or identity-verification interaction does not create that relationship. A business may still be a when it has a direct relationship but sells information about that consumer that it did not collect directly.
Complete the applicable DROP account, registration, and fee steps, then select all six list types that can match the broker's holdings: name plus date of birth plus ZIP code, email, phone, mobile advertising ID, name plus VIN, and connected-TV identifier. Fewer lists are allowed only when identifiers across multiple lists lead to the exact same consumers in the broker's records.
For each download, standardize the broker's records, hash them under the current technical specification, and compare hashes locally. A match requires deletion of all non-exempt personal information and instructions to service providers and contractors, not only deletion of the submitted identifier. Where one matched identifier maps to multiple consumers, opt all linked consumers out of sale and sharing and direct downstream providers to do the same.
Report Deleted for a match followed by deletion of non-exempt data, Opted out for the shared-identifier outcome, Exempted only when matched information is exempt, and Not found only after the required matching process finds no match. CalPrivacy's processing page explains the technical steps but labels itself guidance; the Delete Act and regulations control if the guidance and binding text differ.
The data-broker privacy or DROP operations owner should maintain the record. It must support the recurring download-process-report cycle and show why each request received its status without retaining raw DROP identifiers or suppression data beyond what ongoing compliance needs.
Review every cycle for missed downloads, unselected identifier lists, failed normalization or hashes, partial dataset coverage, wrong status codes, incomplete downstream action, and records collected again after deletion. Re-test after changes to identifiers, matching logic, data stores, acquisitions, vendors, or the official DROP technical specification.
This California Delete Act guide turns data broker deletion workflows into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn Data Broker Deletion Workflow into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"Data brokers must register and pay the annual fee between January 1-31, 2026, through the Delete Request and Opt-Out Platform (DROP)."
"By January 1, 2026, the California Privacy Protection Agency shall establish an accessible deletion mechanism"
"DATA BROKER REGISTRY / DELETE ACT effective 01/01/2026"