Privacy Law Library

Data Broker Registration law and the Delete Act (SB 362), with the Delete Request and Opt-out Platform (DROP)

Delete Act

Data brokers

Requires data brokers to register every year with the California Privacy Protection Agency and disclose what data they collect. The 2023 Delete Act (SB 362) moved the registry from the Attorney General to the Agency and required a single, free deletion mechanism; the Agency launched DROP on January 1, 2026, and registered brokers must process DROP deletion requests every 45 days starting August 1, 2026. SB 361 (2025) added more registration disclosures.

Where
California
Citation
Cal. Civ. Code 1798.99.80-1798.99.89 (Title 1.81.48); Cal. Code Regs. tit. 11, 7600 et seq.
Status
In force
In force since
2020-01-01
Last amended
2026-01-01
Enforced by
California Privacy Protection Agency (CalPrivacy)
People can sue
No
Penalties
Administrative fine of $200 per day for failing to register, plus unpaid fees and costs; $200 per deletion request per day for failing to process DROP deletions, plus costs (1798.99.82(c)-(d)).
Applies to
  • Data brokers: businesses that knowingly collect and sell to third parties the personal information of consumers with whom they have no direct relationship (1798.99.80(c))
  • Excludes entities to the extent covered by FCRA, GLBA, the Insurance Information and Privacy Protection Act, or the CCPA's HIPAA/CMIA exemption

What a privacy notice must say

  • By July 1 each year, publish in the privacy policy the number of consumer privacy requests received, complied with, and denied, and median and mean response times.Cal. Civ. Code 1798.99.85

Practices it requires

  • Beginning August 1, 2026, access DROP at least every 45 days, delete personal information of requesting consumers within 45 days, and direct service providers and contractors to delete.Cal. Civ. Code 1798.99.86(c)(1) · From 2026-08-01
  • If a DROP deletion request cannot be verified, treat it as an opt-out of sale or sharing.Cal. Civ. Code 1798.99.86(c)(1)(B) · From 2026-08-01
  • After deletion, keep deleting new data about the consumer at least every 45 days and do not sell or share new personal information about them.Cal. Civ. Code 1798.99.86(d) · From 2026-08-01

Registration

  • Register with the Agency by January 31 after each year the business was a data broker, pay the fee, and disclose contact details and whether it collects listed data types (e.g., minors' data, precise geolocation, reproductive health data, biometrics) and sells to foreign actors, governments, or generative AI developers.Cal. Civ. Code 1798.99.82(a)-(b)

Other duties

  • Undergo an independent compliance audit every three years starting January 1, 2028, and keep audit reports for six years.Cal. Civ. Code 1798.99.86(e) · From 2028-01-01

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: AB 883 (2026), which would shorten the data broker processing deadline from 45 to 30 days, was on the Governor's desk as of 2026-09-25.

Research reference, not legal advice.