Delete Act
California Delete Act (SB 362)
Lets a California resident ask every registered data broker to delete their data with one request, which brokers must check and process on a fixed schedule.
The law in brief
The California Delete Act (SB 362, 2023) strengthened the state's data broker registry and gave California residents a single place to ask every registered data broker to delete their personal information. That place is the Delete Request and Opt-Out Platform (DROP), run by the California Privacy Protection Agency.
Consumers have been able to submit requests through DROP since 1 January 2026. From 1 August 2026, registered data brokers must retrieve and process those requests on a fixed schedule.
Who it applies to
- Data brokers: businesses that knowingly collect and sell to third parties the personal information of consumers with whom they do not have a direct relationship.
- Businesses covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the Insurance Code are excluded to the extent their activities are covered by those laws.
- The consumer is any California resident.
What it requires
Register every year
Register with the California Privacy Protection Agency, pay the fee, and disclose the information the law requires, such as whether you collect data of minors, precise geolocation or reproductive health care data.
Process DROP requests
From 1 August 2026, access DROP at least once every 45 days, process all deletion requests, and direct service providers and contractors to delete as well.
Keep deleting
After a consumer's request, continue deleting their personal information at least every 45 days and do not sell or share new data about them, unless they ask otherwise.
Independent audits
Undergo an independent audit of compliance every three years starting in 2028, and give the report to the Agency on request.
People's rights
California residents can submit one verifiable request through DROP asking every registered data broker to delete their personal information and to stop selling or sharing it. Brokers must keep deleting newly collected data about that consumer at each retrieval unless the consumer asks otherwise.
Enforcement and penalties
Administrative fines for failing to register, set per day of failure, and for failing to process a deletion request, set per request per day, plus the costs of enforcement. The California Privacy Protection Agency enforces.
What's changing
Now in operation. DROP opened to consumers on 1 January 2026 and brokers' processing duty began on 1 August 2026. Independent audits of brokers' compliance begin in 2028 and recur every three years. Regulatory Watch reports the Agency's rules and enforcement.
What to do first
- Decide whether you are a data broker: do you sell personal information about Californians you have no direct relationship with?
- Register with the Agency each year and keep the registration details accurate.
- Connect to DROP and retrieve requests at least every 45 days.
- Delete matching records and direct your service providers and contractors to delete them.
- Keep deleting newly collected data about those consumers at each retrieval.
- Prepare for the 2028 audit with records of every retrieval and deletion.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Sources
- Data brokers: registry and the Delete Request and Opt-Out Platform California Privacy Protection Agency · Official text or regulator