California's new one-click data deletion system is up and running, and data brokers face an important compliance deadline on October 29, 2026.
The California Privacy Protection Agency (CalPrivacy) recently reminded data brokers active in its Delete Request and Opt-Out Platform (DROP) that they must complete at least one full cycle of processing consumer deletion requests by October 29. Brokers must also complete processing within 45 days of their initial download.
What Is DROP, and Who Does It Apply To?
Launched in January 2026 under California's Delete Act, DROP allows California residents to request deletion of their personal information from hundreds of registered data brokers through a single online submission, rather than contacting each company individually.
The law generally applies to businesses that knowingly collect and sell personal information about California residents to third parties without having a direct relationship with those consumers, subject to statutory exceptions. Depending on their activities, this may include lead generators, marketing data providers, and companies that sell consumer information.
Since August 1, covered data brokers have been required to regularly download consumer deletion requests, match them against their records, delete applicable information subject to legal exceptions, and report their results through DROP. They must also maintain processes to prevent prohibited reacquisition of consumer information.
More Changes Are Coming in 2027
The October deadline is only the first milestone. Two important changes are coming:
Shorter processing deadlines: Beginning January 1, 2027, AB 883 reduces the recurring DROP access and deletion processing timeline from 45 to 30 days.
Higher registration fees: CalPrivacy's Board approved a $9,500 annual registration fee for 2027, plus applicable payment processing fees. Businesses that operated as data brokers at any point during 2026 must register during the 2027 registration period.
CalPrivacy has also warned that initial request volumes may be higher than expected and encouraged brokers to monitor processing status and coordinate with third-party vendors handling requests.
For companies involved in lead generation or consumer data sales, the first question is whether their activities qualify them as data brokers under California law. Those already subject to DROP should ensure their systems and vendors can meet the current processing requirements and the shorter deadlines coming in January.