CALIFORNIA DELETE ACT
California has significantly strengthened its consumer privacy laws with the introduction of the California Delete Act (Senate Bill 362), a landmark law that provides state residents with the ability to demand the deletion of their personal information from data brokers through a single, streamlined request. Signed into law by the Governor on October 10, 2023, the Act is set to fundamentally change the data broker industry’s obligations and a consumer’s ability to manage their digital footprint.
Legal advice can help businesses, local jurisdictions and other entities ensure compliance with the California Delete Act and help residents protect their rights.
Addressing the Loopholes of the CCPA
Before the Delete Act, California residents could request deletion of their data under the existing California Consumer Privacy Act (CCPA) and the CPRA amendment. However, this process was cumbersome as consumers had to submit individual requests to each business holding their data. Furthermore, the CCPA only mandated the deletion of data collected directly from the consumer, leaving information acquired by data brokers from other sources largely untouched. The Delete Act was specifically designed to close these loopholes.
Key Provisions of the Delete Act
The Delete Act introduces several major components designed to enhance consumer control and data broker accountability:
A “One-Stop” Deletion Mechanism: The core of the Delete Act is the creation of a centralized, state-hosted website called the Delete Request and Opt-out Platform (DROP). Starting January 2026, Californians will be able to submit a single, verifiable request through the California Privacy Protection Agency (CPPA) platform to have their personal information deleted by all registered data brokers.
Mandatory Data Broker Compliance: The Delete Act broadly defines a “data broker” to include all businesses (with a few exceptions) that knowingly collect and sell to third parties the personal information of a consumer with whom the business does not have a direct relationship. All data brokers must register with the California Privacy Protection Agency annually in January, and pay a fee that funds the Data Broker Registry and the Delete Request and Opt-Out Platform. Beginning August 1, 2026, registered data brokers must access the DROP system at least every 45 days to retrieve and process all new deletion requests.
Enhanced Transparency and Disclosure: Data brokers are subject to stricter annual registration requirements and must disclose specific statistics on their responses to deletion requests, including the time taken and number of requests denied. They must also disclose whether they collect sensitive information like reproductive healthcare data, precise geolocation data, and minors’ data.
Audits and Enforcement: The California Privacy Protection Agency has been granted regulatory and enforcement authority over data brokers and the existing data broker registry. The agency is actively pursuing enforcement actions against non-compliant brokers. Starting in 2028, data brokers will also be required to undergo independent, triennial audits to verify their compliance with the Delete Act.
Timeline for Implementation
The Delete Act’s provisions are being implemented in stages:
- October 10, 2023: Act signed into law.
- January 2026: Consumers can begin submitting delete requests through the California Privacy Protection Agency’s new DROP website.
- August 1, 2026: Data brokers must begin accessing the DROP every 45 days to process deletion requests.
- January 1, 2028: Independent audit requirements for data brokers go into effect.
A Potential Nationwide Impact
While the Delete Act is a California-specific law, the state’s large population and market size mean its practical effects may be felt nationwide, as companies adjust their practices to comply with California’s stringent regulations. The Act represents a significant step toward providing individuals with greater control over their digital privacy and may serve as a template for other states considering similar legislation.
Contact us by phone or email to learn more about how we can help.