California Delete Act Data Broker Registry and DROP

Start with the statutory definition: a data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship. The statute excludes specified entities to the extent covered by laws such as the FCRA, GLBA, and California's Insurance Information and Privacy Protection Act, and it contains further exemptions. Analyze each business line and data flow rather than relying on the company label.

A business that met the definition in the prior year must register with the California Privacy Protection Agency by January 31 and pay the required fee. Registration includes identity and contact information, required activity and request metrics, data-practice disclosures, and other fields specified by statute and regulation. The public registry reflects information submitted by brokers; it is not a substitute for the business's own scope analysis.

DROP launched for California residents on January 1, 2026. Beginning August 1, 2026, a data broker must access the mechanism at least once every 45 days and process requests received through it. Consumers can submit one request that applies to active brokers, subject to the consumer's selections and statutory exceptions.

Beginning August 1, 2026, access DROP at least every 45 days. Within 45 days after receiving a request from the mechanism, process the request, delete personal information related to the matched consumer as required, and direct associated service providers or contractors to delete the related information in their possession.

If the deletion request cannot be verified, process it as an opt-out of sale or sharing within 45 days, subject to the cited statutory limits. A broker may retain information necessary to honor the deletion or opt-out, but may use that retained information only for the permitted purpose.

After completing deletion, delete later-acquired personal information for that consumer at least every 45 days and do not sell or share new personal information unless the consumer requests otherwise or a statutory provision permits it. The consumer-facing site explains that a status may take up to 90 days because brokers retrieve requests on a recurring cycle and then process them.

A direct relationship turns on the consumer's intentional interaction with the business, not merely whether the business can identify, observe, or contact the consumer. Analyze each collection channel and product: a direct relationship for one service does not settle whether another business line brokers information collected without that relationship. An exclusion tied to another law applies only to the extent the statutory wording covers the entity or activity.

DROP deletion has exceptions. Publicly available and exempt information may be retained, and other CCPA deletion exceptions may apply. Record the exact category, legal basis, and resulting DROP status instead of marking the entire consumer record exempt.

The obligations are recurring. Registration is due by January 31 after a year in which the business met the definition; annual metrics are compiled and disclosed by July 1; DROP processing begins August 1, 2026; and independent third-party audits begin January 1, 2028 and repeat every three years.

Maintain a scope memorandum, annual registration calendar, disclosure and metrics workbook, DROP access log, matching specification, request ledger, deletion and opt-out job evidence, exception register, recipient instructions, status reports, and audit records. Reconcile registration disclosures with actual data practices before each filing.

Test the workflow with exact and partial matches, no match, failed verification, exempt and nonexempt data in one profile, service-provider copies, newly acquired data after deletion, and a consumer update. The test should prove the recurring 45-day control as well as the first request outcome.