Data Broker Registration law and the Delete Act (SB 362), with the Delete Request and Opt-out Platform (DROP)

Requires data brokers to register every year with the California Privacy Protection Agency and disclose what data they collect. The 2023 Delete Act (SB 362) moved the registry from the Attorney General to the Agency and required a single, free deletion mechanism; the Agency launched DROP on January 1, 2026, and registered brokers must process DROP deletion requests every 45 days starting August 1, 2026. SB 361 (2025) added more registration disclosures.