California Delete Act, accessible deletion mechanism (DROP) duties from August 1, 2026 (Cal. Civ. Code 1798.99.86(a), (c)(1)(A), (d)(2))
Since August 1, 2026, every registered data broker must pull the state's deletion list at least every 45 days, delete the listed consumers' data within 45 days, and stop selling their new data. The duty reaches the broker's service providers and contractors, not a buyer that already holds the data, but a broker's future supply excludes everyone on the list.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(a) By January 1, 2026, the California Privacy Protection Agency shall establish an accessible deletion mechanism that does all of the following: ... (c) (1) Beginning August 1, 2026, a data broker shall access the accessible deletion mechanism established pursuant to subdivision (a) at least once every 45 days and do all of the following: (A) Within 45 days after receiving a request made pursuant to this section, process all deletion requests made pursuant to this section and delete all personal information related to the consumers making the requests consistent with the requirements of this section. ... (2) Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant to this section, the data broker shall not sell or share new personal information of the consumer unless the consumer requests otherwise”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide