California Delete Act Data broker registry and DROP

The registry and DROP create separate duties under California's Delete Act. Confirm whether each legal entity is a data broker, whether annual registration is due, and whether the entity must connect to and operate the deletion workflow.

Under the statute, a data broker means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. The Fair Credit Reporting Act, Gramm-Leach-Bliley Act, Insurance Information and Privacy Protection Act, and Section 1798.146 exclusions apply only to the extent the entity or processing is covered. A regulated data set does not automatically exclude unrelated brokerage activity.

A qualifying data broker must register with the CPPA by January 31 following each year in which it met the definition, pay the fee, and provide the required registration information. The filing covers the broker's identity and addresses, request metrics, specified data categories and recipients, common data types, regulated activities, and a working link to a rights page that does not use dark patterns. Each distinct legal entity registers separately and must keep its DROP account's trade names and public-facing data-broker websites accurate.

Beginning August 1, 2026, a data broker must download its selected DROP lists at least once every 45 days; signing in alone does not count. A new broker starting after the registration period must create its account before operating and start downloads within 45 calendar days of commencing operations, then register the next January. It must process retrieved DROP deletion requests and report their status by its next access session, no later than 45 days after retrieval; direct associated service providers and contractors to delete; and treat a request it cannot verify as an opt-out of sale or sharing within the statutory limits. Deletion exceptions cover information reasonably necessary for a Civil Code section 1798.105(d) purpose and information exempt under sections 1798.145 or 1798.146; retained exception data may be used only for the applicable exception purpose, not marketing. Section 7613 also excludes qualifying information collected directly from the consumer as a first party; that exception does not cover unrelated brokered copies or inferences.

After completing a DROP deletion, the broker must delete newly collected personal information at least every 45 days and must not sell or share new information unless the consumer requests otherwise or a statutory exception applies. Independent audits begin January 1, 2028 and recur every three years. The broker must keep the report and related materials for at least six years and submit them within five business days if the Agency makes a written request.

Keep the broker-status analysis, direct-relationship and exclusion evidence, annual registration and fee receipt, required public disclosures and metrics, DROP access logs, request receipt and completion dates, deletion and opt-out propagation logs, service-provider instructions, exception decisions, and consumer status records. From 2028, keep each independent audit report and related materials for at least six years.

Common failures include registering only a parent while an unregistered subsidiary independently meets the definition, treating one excluded data set as an entity-wide exclusion, missing the 45-day platform check, failing to propagate a request to service providers, deleting once but continuing to sell newly collected data, or confusing the 2026 operational date with the 2028 audit date.