California Delete Act / DROP
In force California · In force Jan 1, 2024 · next deadline Jan 31, 2027 (in 4 months)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Requires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.
- Who it applies to
- Data brokers: businesses that knowingly collect and sell to third parties the personal information of consumers with whom they do not have a direct relationship (Civ. Code 1798.99.80). No revenue or volume threshold.
- Penalties
- Administrative fines of $200 per day for failure to register, plus unpaid fees; $200 per deletion request per day for failure to delete as required by 1798.99.86; plus reasonable enforcement costs.
- Enforced by
- California Privacy Protection Agency (CalPrivacy)
- Official name
- California Delete Act (SB 362, 2023), Cal. Civ. Code 1798.99.80 et seq., and DROP regulations
- Citation
- SB 362 (Stats. 2023, ch. 709); Cal. Civ. Code 1798.99.80-1798.99.89
- Topics
- privacy, data-access
Research notes
Registration fee reported to rise from $6,000 to $9,500 for 2027 (Alston & Bird, Aug 2026); not verified on cppa.ca.gov. Signing date Oct 10, 2023 per legislative history (chaptered as ch. 709).
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI ActQuestions about California Delete Act / DROP
- What are the California Delete Act / DROP compliance deadlines?
- Jan 1, 2026: DROP opens to consumers. Jan 31, 2026: Annual data broker registration deadline. Aug 1, 2026: Data brokers must begin processing DROP deletion requests. Jan 31, 2027: Annual data broker registration deadline. Jan 1, 2028: Independent third-party audits begin.
- When does California Delete Act / DROP take effect?
- California Delete Act / DROP took effect on Jan 1, 2024. The next milestone is Jan 31, 2027: Annual data broker registration deadline.
- Who does California Delete Act / DROP apply to?
- Data brokers: businesses that knowingly collect and sell to third parties the personal information of consumers with whom they do not have a direct relationship (Civ. Code 1798.99.80). No revenue or volume threshold.
- What are the penalties under California Delete Act / DROP?
- Administrative fines of $200 per day for failure to register, plus unpaid fees; $200 per deletion request per day for failure to delete as required by 1798.99.86; plus reasonable enforcement costs.