California Privacy Protection Agency approves Delete Act rules effective 1 January 2026

What happened

• The California Privacy Protection Agency approved regulations implementing the Delete Act.
• The rules create a state‑hosted Delete Request and Opt‑out Platform (DROP) that lets consumers delete personal data from multiple data brokers with a single click, effective 1 January 2026.
• Data brokers must access DROP at least every 45 days beginning 1 August 2026, delete matching records, and report request status within 45 days.
• The regulations also require brokers to keep a permanent list of deletion requests.

Why it matters

Data brokers operating in California will need to build automated processes to query DROP regularly, delete all matching records—including inferred data—and log each request for audit purposes.

Business impact

Failure to meet the 45‑day access and reporting cycles could expose brokers to enforcement actions and damage consumer trust, while compliance may require system upgrades and staff training.

What to check

1. 1

   Integrate DROP accessHigh priority

   Build or purchase a system that queries the DROP at least every 45 days starting 1 August 2026.

2. 2

   Automate deletionHigh priority

   Delete all personal data and inferences that match a consumer request unless a legal exemption applies.

3. 3

   Report request statusMedium priority

   Submit a status update for each processed request in the DROP within 45 days of retrieval.

4. 4

   Maintain request logMedium priority

   Keep a permanent list of all deletion requests to ensure ongoing compliance.