California Approves Delete Act Regulations

What happened

The California Privacy Protection Agency approved regulations implementing the Delete Act. The rules create a state‑hosted Delete Request and Opt‑out Platform (DROP) that lets consumers delete personal data from multiple data brokers with a single click, effective 1 January 2026. Data brokers must access DROP at least every 45 days beginning 1 August 2026, delete matching records, and report request status within 45 days. The regulations also require brokers to keep a permanent list of deletion requests.

Why it matters

Data brokers operating in California will need to build automated processes to query DROP regularly, delete all matching records—including inferred data—and log each request for audit purposes.

Business impact

Failure to meet the 45‑day access and reporting cycles could expose brokers to enforcement actions and damage consumer trust, while compliance may require system upgrades and staff training.

Checklist

• Integrate DROP accessHigh priority

  Build or purchase a system that queries the DROP at least every 45 days starting 1 August 2026.

• Automate deletionHigh priority

  Delete all personal data and inferences that match a consumer request unless a legal exemption applies.

• Report request statusMedium priority

  Submit a status update for each processed request in the DROP within 45 days of retrieval.

• Maintain request logMedium priority

  Keep a permanent list of all deletion requests to ensure ongoing compliance.

Who reported it

Discussion