California Delete Act Data Broker Registry and DROP
A business that meets California's data-broker definition must register annually and use for deletion requests beginning August 1, 2026.
Keep this Delete Act analysis separate from ordinary CCPA scope. The definition, exclusions, registration disclosures, request cycle, metrics, and audit duties have their own tests.
California's Registry lists businesses that meet the state's definition of a data broker, and is the state's Delete Request and Opt-Out Platform for handling deletion requests. This page explains what the registry and DROP are, who must register, what the annual registration and deletion workflow looks like, and which deadlines, evidence records, and review steps teams should track.
1
Section 1
What should teams decide about Data Broker Registry and DROP under the California Delete Act?
Start with the statutory definition: a is a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship. The statute excludes specified entities to the extent covered by laws such as the FCRA, GLBA, and California's Insurance Information and Privacy Protection Act, and it contains further exemptions. Analyze each business line and data flow rather than relying on the company label.
A business that met the definition in the prior year must register with the California Privacy Protection Agency by January 31 and pay the required fee. Registration includes identity and contact information, required activity and request metrics, data-practice disclosures, and other fields specified by statute and regulation. A business beginning brokerage after January must create a account before operating, start downloads within 45 calendar days of commencing operations, pay any applicable first-time access fee, and register the next January. The public registry records broker submissions and does not replace that scope analysis.
launched for California residents on January 1, 2026. Beginning August 1, 2026, a must access the mechanism at least once every 45 days and process requests received through it. Consumers can submit one request that applies to active brokers, subject to the consumer's selections and statutory exceptions.
Scope: record the business, source of personal information, direct-relationship analysis, sale to third parties, exclusions, and exempt data.
Registration: retain the annual submission, fee receipt, disclosed practices and metrics, authorized contacts, and later corrections.
: retain access logs, request receipt, matching inputs, outcome, deletion and opt-out actions, recipient instructions, and status reporting.
Governance: track July 1 metrics, the January registration cycle, August 1, 2026 processing start, recurring 45-day operations, and the independent-audit cycle beginning in 2028.
Binding text for the data-broker definition and exclusions, January 31 registration, July 1 metrics, and the DROP processing and audit dates.
2
Section 2
How must a data broker process a DROP request?
Beginning August 1, 2026, access at least every 45 days. Within 45 days after receiving a request from the mechanism, process the request, delete personal information related to the matched consumer as required, and direct associated service providers or contractors to delete the related information in their possession.
If the deletion request cannot be verified, process it as an opt-out of sale or sharing within 45 days, subject to the cited statutory limits. A broker may retain information necessary to honor the deletion or opt-out, but may use that retained information only for the permitted purpose.
After completing deletion, delete later-acquired personal information for that consumer at least every 45 days and do not sell or share new personal information unless the consumer requests otherwise or a statutory provision permits it. The consumer-facing site explains that a status may take up to 90 days because brokers retrieve requests on a recurring cycle and then process them.
Privacy operations: own access, matching rules, exception review, outcome reporting, and consumer status evidence.
Data engineering: delete matched records, prevent prohibited resale or sharing, run recurring deletion, and preserve only permitted suppression data.
Recipient management: instruct service providers and contractors, track completion, and investigate data that returns from a source or downstream system.
Legal or privacy: approve exclusions, exemptions, failed-verification opt-out treatment, retained-data purposes, and any denial.
Binding text for 45-day platform access and processing, deletion, failed-verification opt-out treatment, recipient instructions, recurring deletion, and retained-data limits.
3
Section 3
Which exclusions, exceptions, and timing points matter?
A direct relationship turns on the consumer's intentional interaction with the business, not merely whether the business can identify, observe, or contact the consumer. Analyze each collection channel and product: a direct relationship for one service does not settle whether another business line brokers information collected without that relationship. An exclusion tied to another law applies only to the extent the statutory wording covers the entity or activity.
deletion has exceptions. Section 7613 also excludes qualifying first-party information collected directly from the consumer; statutory exemptions and applicable CCPA deletion exceptions may permit retention of other specific information. Record the exact category, legal basis, and resulting DROP status instead of marking the entire consumer record exempt.
The obligations are recurring. Registration is due by January 31 after a year in which the business met the definition; annual metrics are compiled and disclosed by July 1; processing begins August 1, 2026; and independent third-party audits begin January 1, 2028 and repeat every three years.
Distinguish no match, failed verification, partial exemption, full exemption, deletion, and opt-out because each requires different action and evidence. A failed verification must be handled as an opt-out of sale or sharing within the applicable 45-day period rather than closed as no action.
Do not confuse the broker's 45-day duty after receipt with the consumer-facing statement that status may take up to 90 days across the retrieval and processing cycle.
Keep the audit report and related materials for at least six years and be prepared to submit them to the Agency within five business days of a written request.
Reassess scope when acquisition sources, direct consumer interactions, sale practices, legal exclusions, or corporate structure change.
Binding text for exclusions, deletion exceptions, recurring dates, independent audits, five-business-day production, and six-year retention.
4
Section 4
What records and controls should the broker maintain?
Maintain a scope memorandum, annual registration calendar, disclosure and metrics workbook, access log, matching specification, request ledger, deletion and opt-out job evidence, exception register, recipient instructions, status reports, and audit records. Reconcile registration disclosures with actual data practices before each filing.
Test the workflow with exact and partial matches, no match, failed verification, exempt and nonexempt data in one profile, service-provider copies, newly acquired data after deletion, and a consumer update. The test should prove the recurring 45-day control as well as the first request outcome.
Before January 31: confirm prior-year scope, reconcile disclosures and metrics, submit registration, and retain the receipt.
Before July 1: compile and disclose the required prior-year request metrics.
Every cycle: retrieve requests, match, delete or opt out, instruct service providers and contractors, report status, delete later-acquired information for completed matches, and preserve only the suppression data and exempt information allowed for the recorded purpose.
From 2028: complete the independent audit every three years and retain the report and related materials for at least six years.
Binding text for the data-broker definition and exclusions, January 31 registration, July 1 metrics, and the DROP processing and audit dates.
Binding text for 45-day platform access and processing, deletion, failed-verification opt-out treatment, recipient instructions, recurring deletion, and retained-data limits.
Binding text for exclusions, deletion exceptions, recurring dates, independent audits, five-business-day production, and six-year retention.
Show 1 more
Binding text for registration, request metrics, recurring DROP operations, independent audits, and evidence-retention duties.