Data Broker Opt-Out Laws: California's Delete Act and What It Actually Does

Before California's Delete Act, a consumer who wanted their personal information removed from the data broker industry — the loose network of companies that collect, aggregate, and sell personal data without a direct relationship to the people the data describes — faced a genuinely tedious process: identifying which of potentially hundreds of data brokers held their information, then submitting an individual opt-out or deletion request to each one separately, often through inconsistent forms with inconsistent response times. The Delete Act's central innovation is replacing that fragmented process with a single point of contact.

What DROP Actually Is

The Delete Request and Opt-Out Platform, universally referred to by its acronym DROP, is the mechanism the Delete Act actually built to solve this problem. Rather than requiring a consumer to track down and separately contact every data broker that might hold their information, DROP allows a California resident to submit one deletion request through a single platform, which then transmits that request to every data broker registered with the California Privacy Protection Agency (CalPrivacy). Consumers gained the ability to start submitting requests through DROP as of January 1, 2026.

The Gap Between "Registered" and "Required to Comply"

This is the detail most worth understanding precisely, because it explains why DROP's launch date and its actual enforcement date are two different dates roughly seven months apart. Data brokers have been required to register annually with CalPrivacy's Data Broker Registry since it opened on January 1, 2024 — registration itself is an existing, older obligation. But data brokers are not required to actually process deletion requests submitted through DROP until August 1, 2026. Between January and August 2026, a consumer could submit a request through the platform, but registered brokers had no legal deadline yet requiring them to act on it — a genuine, if temporary, gap between the platform going live for consumers and the corresponding obligation going live for the brokers receiving requests through it.

Once the August 2026 compliance date passed, an ongoing obligation kicked in as well: registered data brokers are required to check DROP for new deletion requests at least once every 45 days, rather than only when a request happens to arrive, making certain that "I'll get to it eventually" isn't a viable compliance posture over the long term.

The Financial Penalties Behind the Registration Requirement

California has attached real, escalating financial consequences to brokers that skip the registration step entirely, independent of the DROP deletion process. A 2025 amendment, SB 361, doubled the daily administrative fine for failing to register with CalPrivacy's Data Broker Registry, raising it from $100 to $200 per day — and critically, that fine is assessed per day of non-compliance, meaning the total penalty for a broker that simply never registers accumulates continuously rather than being a fixed, one-time cost a company might simply choose to absorb.

CalPrivacy has already demonstrated it will use its enforcement authority against non-compliant brokers rather than treating registration as merely aspirational: the agency issued a formal decision against a specific company, Cybba Inc., after it failed to meet its 2025 registration deadline — a documented, concrete example of the registry's enforcement mechanism actually being exercised rather than existing only on paper.

Why a Single Platform Is a Meaningfully Different Approach

Prior privacy legislation, including California's own earlier California Consumer Privacy Act (CCPA), generally gave consumers the right to request deletion of their data, but left the practical burden of exercising that right on the individual consumer, one company at a time. The specific design choice behind DROP — centralizing the request into one submission that reaches every registered broker simultaneously — represents a meaningfully different regulatory philosophy: rather than only granting a right and leaving enforcement of the friction involved entirely to the consumer, the law also addresses the practical, logistical barrier that made the underlying right difficult to exercise at meaningful scale in the first place.

What This Doesn't Cover

It's worth being precise about DROP's actual scope: it applies specifically to companies that meet California's statutory definition of a "data broker" and have registered accordingly — a category that doesn't automatically include every company holding personal data about a consumer. A company with a direct consumer relationship (a retailer you've bought from directly, a service you've signed up for yourself) generally falls outside the data-broker-specific framework and is governed instead by California's broader consumer privacy law, the CCPA, which has its own separate deletion-request mechanism. DROP is specifically aimed at the more opaque layer of the data economy — companies that collect and sell information about people who never directly interacted with them — rather than functioning as a universal, one-stop deletion tool covering every company that might hold a Californian's personal data.