California Launches DROP Tool for Consumer Data Deletion
California introduces DROP for streamlined consumer data deletion.
Why it matters: The tool increases compliance responsibilities for general counsels, affecting enterprise operations.
- Governor Newsom signed the Delete Act on October 10, 2023.
- DROP launches January 1, 2026, facilitating consumer data deletion.
- Brokers must comply by August 1, 2026, or face daily fines.
- Over 155,000 deletion requests via DROP initiated by Californians.
On October 10, 2023, Governor Gavin Newsom signed the California Delete Act into law, establishing a streamlined process for consumers to delete their data from brokers. The law took effect on January 1, 2024, and is enforced by the California Privacy Protection Agency.
Beginning January 1, 2026, Californians can use the Deletion Registry Online Program (DROP) to submit a single data deletion request that applies to all registered data brokers. This simplifies the process for consumers, who previously had to contact each broker individually.
Data brokers are obligated to comply with the deletion requests by August 1, 2026, and must continue to verify their compliance every 45 days. Failing to do so may incur a fine of $200 per day for each affected consumer, marking stringent enforcement measures.
Over 155,000 Californians have already utilized DROP to initiate deletion requests, underscoring the public's demand for more control over personal data. The law also mandates that data brokers undergo audits every three years starting January 1, 2028, to ensure continued compliance.
Governor Newsom stated that the DROP initiative showcases "California's leadership in setting new privacy standards," a sentiment that could drive other states to adopt similar privacy-focused legislation.
By the numbers:
- $200 — Daily fine for broker non-compliance per consumer
- 3 years — Frequency of mandatory broker audits starting 2028
- 155,000+ — Initial consumer deletion requests via DROP