Search every question across sub-FAQs

The registry and DROP create separate duties under California's Delete Act. Confirm whether each legal entity is a data broker, whether annual registration is due, and whether the entity must connect to and operate the deletion workflow.

Under the statute, a data broker means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. The Fair Credit Reporting Act, Gramm-Leach-Bliley Act, Insurance Information and Privacy Protection Act, and Section 1798.146 exclusions apply only to the extent the entity or processing is covered. A regulated data set does not automatically exclude unrelated brokerage activity.

A qualifying data broker must register with the CPPA by January 31 following each year in which it met the definition, pay the fee, and provide the required registration information. The filing covers the broker's identity and addresses, request metrics, specified data categories and recipients, common data types, regulated activities, and a working link to a rights page that does not use dark patterns. Each distinct legal entity registers separately and must keep its DROP account's trade names and public-facing data-broker websites accurate.

Beginning August 1, 2026, a registered data broker must access the Delete Request and Opt-Out Platform (DROP) at least once every 45 days. It must process retrieved DROP deletion requests and report their status by its next access session, no later than 45 days after retrieval; direct associated service providers and contractors to delete; and treat a request it cannot verify as an opt-out of sale or sharing within the statutory limits. Deletion exceptions cover information reasonably necessary for a Civil Code section 1798.105(d) purpose and information exempt under sections 1798.145 or 1798.146; retained exception data may be used only for the applicable exception purpose, not marketing.

After completing a DROP deletion, the broker must delete newly collected personal information at least every 45 days and must not sell or share new information unless the consumer requests otherwise or a statutory exception applies. Independent audits begin January 1, 2028 and recur every three years. The broker must keep the report and related materials for at least six years and submit them within five business days if the Agency makes a written request.

Keep the broker-status analysis, direct-relationship and exclusion evidence, annual registration and fee receipt, required public disclosures and metrics, DROP access logs, request receipt and completion dates, deletion and opt-out propagation logs, service-provider instructions, exception decisions, and consumer status records. From 2028, keep each independent audit report and related materials for at least six years.

Common failures include registering only a parent while an unregistered subsidiary independently meets the definition, treating one excluded data set as an entity-wide exclusion, missing the 45-day platform check, failing to propagate a request to service providers, deleting once but continuing to sell newly collected data, or confusing the 2026 operational date with the 2028 audit date.

CPPA Enforcement Advisories discuss selected CCPA statutes and regulations and show issues the Enforcement Division is watching. They do not implement or interpret the law, establish substantive policy or rights, constitute legal advice, reflect the Board's views, or provide a safe harbor. The statute and regulations control if an advisory appears to conflict with them, and the Enforcement Division makes case-by-case decisions.

Use an advisory as an enforcement-priority and control-review signal. Advisory 2024-01, issued April 2, 2024, applies data minimization to consumer requests and warns against excessive verification data. Advisory 2024-02, issued September 4, 2024, addresses dark patterns, plain language, and symmetry in privacy choices. Advisory 2025-01 addresses timely and complete data-broker registration, including separate registrations for qualifying subsidiaries and accurate trade names and websites.

For each relevant advisory, identify the binding provision it cites, then compare the actual facts with both the rule and the advisory's hypothetical. For 2024-01, test what information each request path collects and why it is necessary. For 2024-02, compare the time, steps, wording, and visual treatment for privacy-protective and less protective choices. For 2025-01, test each legal entity's registration, payment, trade names, websites, and DROP account. Assign an owner and record the legal source, factual comparison, decision, remediation, and retest date.

Keep the advisory number and publication date, the binding provisions it cites, an inventory of affected interfaces or processing, screenshots or tests of current behavior, the factual comparison, the gap decision, remediation ticket, owner approval, and dated retest. Preserve the version reviewed because a later enforcement action or guidance document may address the topic differently.

Common failures include treating an advisory as binding law, assuming it offers a safe harbor, copying a hypothetical conclusion without matching the facts, citing only the advisory instead of the underlying rule, or updating policy text without fixing the interface, request workflow, or registration record at issue.

A covered business that sells or shares personal information must treat a qualifying Global Privacy Control or other opt-out preference signal as a request to opt out for the browser or device that sends it. The signal must use a format commonly used and recognized by businesses, such as an HTTP header or JavaScript object, and the sending mechanism must make clear that it is meant to opt the consumer out of sale and sharing. If the business knows the consumer, the signal also applies to the consumer and associated profiles, including pseudonymous profiles. The signal is a request made directly by the consumer, so the business cannot require signed authorization or verification.

The business must process the signal even if it also posts a "Do Not Sell or Share My Personal Information" link. It may omit that link only if it meets the separate statutory and regulatory conditions for frictionless processing, including fully effectuating the opt-out and making the required privacy-policy disclosures. Frictionless processing cannot charge a fee, change the product experience, or display an interstitial in response to the signal.

GPC covers sale and sharing. Deletion, correction, access, and sensitive-data limitation use their own request processes. Map the signal to every relevant online sale and cross-context behavioral advertising flow, the associated profile when known, and downstream recipients. Stop sale or sharing as soon as feasibly possible and no later than 15 business days, notify affected third parties for transfers during that period, show a confirmation state, and keep dated logged-in and logged-out tests.

Keep browser and device test cases, the raw signal observed, linked-profile behavior, sale/share tags blocked, downstream instructions, conflict and consent handling, privacy-choice status shown to the consumer, persistence tests, and dated results across logged-in and logged-out journeys.

Common failures include detecting GPC without changing downstream behavior, honoring it only after login, treating a cookie banner as the sale-or-sharing request mechanism, claiming frictionless processing when offline sales remain unaffected, overriding the signal with an older cookie or account setting without following the conflict rule, or blocking one ad-tech endpoint while other sale or sharing flows continue.

Trace the information from collection to the advertising recipient and ask four questions: Is it personal information? Does the business communicate or make it available to another person? Is that person a third party for this service? Will the recipient target advertising using information obtained from the consumer's activity across other businesses or distinctly branded sites, apps, or services? If all four answers are yes, the flow is sharing even when the arrangement is unpaid.

The statute excludes three situations from sharing: the consumer directs an intentional disclosure or intentionally interacts with a third party; the business passes an opt-out or sensitive-information limitation identifier so others can honor the choice; or personal information transfers as an asset in a merger, acquisition, bankruptcy, or similar change-of-control transaction and remains subject to the statutory conditions. These are narrow exclusions. A consumer's ordinary use of a website is not enough by itself to show that the consumer directed an ad-tech disclosure.

Contextual or nonpersonalized advertising based only on the consumer's current interaction can fall outside cross-context behavioral advertising. A service provider or contractor may provide advertising or marketing services, but cannot contract to provide cross-context behavioral advertising in that role. A person providing cross-context behavioral advertising is a third party for that service. The label in the contract does not override the recipient's actual use of the data.

A business that shares must tell consumers that their personal information may be sold or shared and that they have a right to opt out. Its privacy policy must describe the right and the available method. Unless the business qualifies for the frictionless preference-signal alternative in Civil Code section 1798.135(b) and section 7025 of the regulations, it must also provide the required "Do Not Sell or Share My Personal Information" link or compliant alternative link.

The business must offer at least two designated opt-out methods, chosen for how it interacts with consumers and collects the information. An online business must, at minimum, accept a qualifying opt-out preference signal and provide an interactive form through the required link, alternative link, or privacy policy when the frictionless alternative applies. It cannot require an account or identity verification and may request only information needed to carry out the opt-out.

A qualifying opt-out preference signal applies to the browser or device and associated consumer profiles, including pseudonymous profiles. If the business knows the consumer, it must also apply the signal to that consumer. An anonymous browser signal does not require the business to connect data it cannot reasonably associate with that browser. Posting an opt-out link does not excuse the business from processing qualifying signals.

Stop sharing as soon as feasibly possible and no later than 15 business days after receiving the request. Notify third parties that received the consumer's information after the request but before compliance, direct them to honor the request, and require them to pass it to anyone to whom they made the information available during that period. The business must provide a way for the consumer to confirm that the opt-out was processed and generally must wait at least 12 months before asking the consumer to consent again.

A business that shares with a third party must have an agreement identifying the limited and specified purposes, limiting the third party to those purposes, requiring the same level of CCPA protection for the information, and giving the business rights to check, stop, and remediate unauthorized use. The agreement must also require notice if the third party can no longer comply. A service-provider or contractor agreement needs the separate terms in section 7051; using that label without the required contract and restricted use may leave the recipient outside that role.

Keep a dated inventory of advertising technologies and server-side transfers; data-flow and recipient-role maps; the sale and sharing analysis; contracts and due diligence; privacy-policy and choice-interface captures; preference-signal test results; consent and under-16 authorization records where applicable; suppression and downstream-notification logs; confirmation-state tests; and retests after material product, vendor, or purpose changes.

Test actual behavior before and after an opt-out. Common failures include sending identifiers before the choice takes effect, failing to cover server-side transfers or a known consumer's linked profile, treating an unpaid disclosure as outside sharing, or relying on contract wording while the recipient combines data for cross-context advertising.

Apply four gates to each use. First, confirm that the entity is a covered CCPA business. Second, identify whether the technology processes personal information and uses computation. Third, decide whether its output replaces or substantially replaces a person's decision; human involvement requires a reviewer who understands the output, considers other relevant information, and can change the result. Routine storage, firewall, calculator, database, and spreadsheet functions remain outside the definition when they do not replace human decisionmaking.

Fourth, connect the output to a significant decision about the consumer. Article 11 covers decisions that provide or deny financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services. Advertising is excluded. A prediction, score, ranking, or recommendation can still be covered when the business uses it to make a listed decision without qualifying human review.

Representative covered examples include software that screens resumes to decide whom to hire, evaluates productivity to allocate work or compensation, screens student work to decide suspension, or scores an exam to decide whether to grant a diploma. These examples depend on how the business uses the output. The same software used only to organize records or assist a reviewer who retains real decision authority may fall outside the ADMT definition.

The regulations became effective January 1, 2026, but Article 11 has a separate compliance date. A business using covered ADMT before January 1, 2027 must comply by January 1, 2027; a use beginning on or after that date must comply whenever it is used. Before processing, provide a Pre-use Notice that states the specific purpose, data categories affecting the output, output type, role of the output and any human reviewer, access right, opt-out or appeal path, and alternative decision process. The same use may also require a risk assessment before it begins or materially changes.

Consumers generally receive access and opt-out rights. An opt-out exception applies only if its conditions are met. One exception replaces opt-out with an appeal to a human reviewer who understands the output, considers the consumer's information, and can overturn the decision. Separate exceptions for specified admission, hiring, work-allocation, and compensation uses require the ADMT to work for the stated purpose and not unlawfully discriminate; document the exact exception rather than treating these fields as categorically exempt.

Keep the ADMT inventory, significant-decision analysis, purpose, data categories, logic and output documentation, Pre-use Notice, access and opt-out tests, exception and appeal analysis, human-review authority, vendor terms, related risk assessment, approval, and January 1, 2027 readiness evidence. Record material changes because they can require the analysis, risk assessment, and notice to be updated.

For each consumer request, retain the receipt date, verification record where required, response or appeal due date, information supplied, outcome, and downstream action. Keep test evidence showing that opt-out routes do not require an account or unnecessary data and that the non-ADMT alternative or human appeal works in the live decision process.

Common failures include classifying a nominal human check as meaningful review when the reviewer cannot change the decision, treating every automated tool as covered, overlooking employment or independent-contractor decisions, using a generic privacy notice instead of a pre-use notice, or claiming an opt-out exception without implementing the required appeal path.