Accessible Deletion Mechanism for Data Brokers

CPPA California Privacy Rulemaking

Published January 1st, 2026

Detected March 13th, 2026

Summary

The California Privacy Protection Agency has finalized regulations establishing an Accessible Deletion Mechanism (DROP) for data brokers, effective January 1, 2026. This system allows consumers to request the deletion of their personal information from registered data brokers through a single request to the agency.

View original document View source feed page

What changed

The California Privacy Protection Agency (CPPA) has adopted final regulations establishing the Delete Request and Opt-out Platform (DROP) system, mandated by Senate Bill 362. This new mechanism requires registered data brokers to honor consumer deletion requests submitted through a centralized platform managed by the CPPA. The regulations specify system requirements for data brokers to facilitate these requests, aiming to provide consumers with a more accessible way to control their personal information.

Data brokers operating in California must prepare to integrate with and comply with the DROP system by January 1, 2026. This will involve updating their internal processes to handle deletion requests originating from the CPPA platform and ensuring all non-exempt personal information related to the consumer is deleted. Failure to comply may result in regulatory action by the CPPA, although specific penalties are not detailed in this document, the underlying Delete Act implies enforcement powers.

What to do next

Review the CPPA's DROP system requirements and approved regulations.
Update internal data deletion processes to accommodate requests via the centralized DROP platform.
Ensure compliance with the accessible deletion mechanism by January 1, 2026.

Source document (simplified)

Accessible Deletion Mechanism –

        Delete Request and Opt–out Platform (“DROP”) System Requirements

In 2023, the Legislature passed the Delete Act (Senate Bill (SB) 362, Chapter 709, Statutes of 2023), which
requires the Agency to establish an accessible deletion mechanism that allows consumers to request from
registered data brokers the deletion of all non–exempt personal information related to the consumer
through a single deletion request to the Agency. On September 26, 2025 the California Privacy Protection Agency
adopted regulations on the subject of the Accessible Deletion Mechanism.

Effective Date: January 1, 2026

Status of the Proposal: The rulemaking is complete. On November 6, 2025, the regulations were approved by the Office of Administrative Law and filed with the Secretary of State.

Rulemaking Documents

November 6, 2025 – Final Rulemaking Documents

Notice of Approval
Approved Regulations Text
Final Statement of Reasons and Update to Informative Digest
Final Statement of Reasons – Appendix A (45-Day Comment Summaries and Responses)
Final Statement of Reasons – Appendix B (15-Day Comment Summaries and Responses)
Final Economic and Fiscal Impact Statement (STD 399)
July 31, 2025 – Public Notice of Modifications to Proposed Regulations
Notice of Modifications to Text of Proposed Regulations
Modified Text of Proposed Regulations
April 25, 2025 - Public Notice of Rulemaking and Related Documents
Notice of Proposed Rulemaking
Text of Proposed Regulation
Initial Statement of Reasons
Economic and Fiscal Impact
Statement (STD 399)

Public Comments

Comments received during the initial (April 25, 2025 – June 10, 2025) comment period are linked
below.

Delete Request and Opt–out Platform ("DROP") System Requirements – Part 1
Delete Request and Opt–out Platform ("DROP")
System Requirements – Part 2
Transcript of comments received during the
June 10, 2025 Public Comment Hearing
Comments received during the July 31, 2025 – August 18, 2025 comment period are linked below.
Delete Request and Opt–out Platform ("DROP")
System
Requirements

Preliminary Rulemaking Activities

The California Privacy Protection Agency solicited preliminary written comments from the public via an Invitation for Preliminary Comments on Proposed
Rulemaking on the following topics: Verifiable Consumer Requests, Privacy–protecting, Status of
Request, and Consumer Experience from May 31, 2024 through June 25, 2024. That period is now closed, and the
public comments are available via the links below.