Delete Act

The California Delete Act (SB 362, 2023) strengthened the state's data broker registry and gave California residents a single place to ask every registered data broker to delete their personal information. That place is the Delete Request and Opt-Out Platform (DROP), run by the California Privacy Protection Agency.

Consumers have been able to submit requests through DROP since 1 January 2026. From 1 August 2026, registered data brokers must retrieve and process those requests on a fixed schedule.

• Data brokers: businesses that knowingly collect and sell to third parties the personal information of consumers with whom they do not have a direct relationship.
• Businesses covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the Insurance Code are excluded to the extent their activities are covered by those laws.
• The consumer is any California resident.

California residents can submit one verifiable request through DROP asking every registered data broker to delete their personal information and to stop selling or sharing it. Brokers must keep deleting newly collected data about that consumer at each retrieval unless the consumer asks otherwise.

Amendes administratives en cas de défaut d’enregistrement, fixées par jour de manquement, et en cas de non-traitement d’une demande de suppression, fixées par demande et par jour, plus les frais d’exécution. L’Agence californienne de protection de la vie privée assure l’application.

1. Decide whether you are a data broker: do you sell personal information about Californians you have no direct relationship with?
2. Register with the Agency each year and keep the registration details accurate.
3. Connect to DROP and retrieve requests at least every 45 days.
4. Delete matching records and direct your service providers and contractors to delete them.
5. Keep deleting newly collected data about those consumers at each retrieval.
6. Prepare for the 2028 audit with records of every retrieval and deletion.