California gave consumers a single switch to make every registered data broker delete their data. If you're a broker, that switch creates a recurring legal duty — and a clock. Here's what the law requires and why automating it is the only sane path.
The California Delete Act — Senate Bill 362, signed into law in 2023 — builds on the CCPA by creating one place where a consumer can ask all registered data brokers to delete their personal information at once. The California Privacy Protection Agency (CPPA) operates that mechanism: the Delete Request and Opt-out Platform (DROP).
Before the Delete Act, a consumer had to find and contact each broker individually. Now they make one verified request, and the obligation to act lands on every registered broker simultaneously — on a repeating schedule.
The law applies to data brokers: businesses that knowingly collect and sell the personal information of consumers with whom they don't have a direct relationship. If your business is required to register as a data broker with the CPPA, the Delete Act's deletion obligations apply to you. Registration itself is an annual requirement, and failing to register carries its own daily penalty.
Quick self-check. You may be a data broker if you: buy or compile consumer lists and resell them; enrich third-party data for others; operate a lead marketplace; or aggregate public records + contact info for commercial use — and you don't have a direct relationship with those consumers. When in doubt, consult counsel; the CPPA registration portal is the definitive step.
The processing deadline is close. Once brokers are required to process requests, the duty doesn't pause — it recurs every 45 days. Standing up a reliable, auditable cycle takes lead time, which is exactly what Drop Privacy gives you out of the box.
Deletion vs opt-out: consumers use one state platform (DROP) for both. Your job each cycle is to match their request against your data, delete what you must, honor opt-outs, and document the outcome — Drop Privacy handles the matching, classification, API response, and audit trail.
The Delete Act attaches real cost to inaction. Failing to register as a data broker carries a statutory penalty of $200 per day. Deletion and audit violations expose brokers to administrative fines that accrue over time, on top of existing CCPA enforcement and the reputational damage of a public compliance failure. Because the obligation is continuous, a process that "mostly works" quietly compounds risk every 45 days.
Matching a state-issued deletion batch against hundreds of millions of consumer records — accurately, every 45 days, while keeping evidence you can defend — is not a spreadsheet task. It's an engineering problem with a deadline attached. Drop Privacy exists to make that problem disappear: it indexes your data privately, matches the batch, decides each record, responds, suppresses forward, and produces the proof — on a schedule, without exposing PII.
See how Drop Privacy runs the full Delete Act cycle for you — and hands you the attestation at the end.