On November 13, the California Privacy Protection Agency (CPPA) announced that the Office of Administrative Law approved final regulations implementing the Delete Act, establishing a new statewide data deletion mechanism. As previously covered by InfoBytes, the regulations create the “Delete Request and Opt-out Platform” (DROP), a state-hosted website allowing California consumers to request deletion of their personal information from multiple data brokers with a single action.
Under the regulations, which take effect January 1, 2026, consumers will be able to submit delete requests through DROP. Under the rules, data brokers must access the DROP at least every 45 days to retrieve and process deletion requests. If a consumer’s details correspond to a data broker’s records, the broker will be obligated to remove all related personal information, including inferred data, unless an exemption under the law applies. Data brokers must update the DROP platform on the status of each deletion request within 45 days and are required to keep records of all requests.
The CPPA released a presentation from its November 7 meeting, during which the final regulations were approved. The presentation outlined the consumer experience for submitting and tracking deletion requests as well as the technical and compliance steps and timelines data brokers will be obliged to follow to ensure compliance once the regulations take effect.
[View source.]
