California Delete Act: How SB 362 and DROP Work

The California Delete Act gives California residents a simpler way to ask data brokers to delete their personal information. Instead of finding each broker and filling out separate forms, residents can submit one request through the state’s Delete Request and Opt-out Platform, known as DROP. For businesses, the law raises a different question: does collecting customer data make a company a data broker? Usually, that fact alone is not enough. The answer depends on the company’s activities, its relationship with consumers, and whether it meets the relevant legal definitions.

This guide explains who the law covers, how requests work, and what businesses need to manage. It also separates data broker duties from ordinary website privacy controls, which address different parts of the customer data journey.

What Is The California Delete Act, SB 362?

The California Delete Act is a state law introduced through Senate Bill 362, signed on October 10, 2023. It expanded California’s data broker rules and required a central system for deletion requests.

The California Privacy Protection Agency, also called CalPrivacy, runs that system. DROP opened to consumers on January 1, 2026. Brokers became responsible for retrieving and processing requests beginning August 1, 2026.

The law addresses a practical problem. People may know which stores they shop at, but they rarely know every company that buys and sells information about them. A broker may hold a profile of someone who has never visited its website or heard its name.

DROP reduces the work needed to reach those businesses. It also creates continuing responsibilities, rather than treating deletion as a single cleanup task.

The Delete Act works alongside the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). It does not replace the broader rights to access, correct, delete, or restrict certain uses of personal information.

Who Must Comply With The California Delete Act?

The central obligations apply to businesses that meet California’s definition of a data broker. Two questions help organize the assessment: is the organization a covered business, and does it engage in data brokering?

Does the business meet the CCPA coverage rules?

Broadly, the CCPA covers certain for-profit businesses doing business in California that determine why and how personal information is processed and meet at least one qualifying threshold.

The revenue figure reflects the inflation adjustment effective January 1, 2025. Older guides often repeat $25 million, but that is not the adjusted threshold applicable in 2026.

These are alternative tests. A company below the revenue threshold may still qualify through its data activities. The full CCPA coverage rules also address certain related entities and other arrangements, so the table is a starting point rather than a complete legal assessment.

Does it collect and sell information without a direct relationship?

A data broker knowingly collects and sells personal information to third parties about consumers with whom it lacks a direct relationship.

For example, a company that assembles profiles from outside sources and sells them to advertisers may fall within that definition. A store that collects a delivery address to fulfill a shopper’s order does not become a data broker merely by holding that address.

The implementing regulations add an important distinction: a direct relationship requires intentional interaction with the business. Quietly collecting information does not establish that relationship. Neither does receiving a privacy request.

A business can also have mixed activities. Selling products to some customers does not automatically protect a separate operation that sells externally collected information about those people. Review each data source and use, rather than relying only on the company’s main industry label.

Are there exemptions?

The definition contains exclusions tied to laws such as the Fair Credit Reporting Act, Gramm-Leach-Bliley Act, California insurance privacy law, and specified healthcare privacy exemptions.

Their scope matters. A business should identify which activity or information is covered by an exclusion instead of assuming that a financial, insurance, or healthcare connection exempts everything it does.

How Does California Delete Act DROP Work For Consumers?

DROP is free for California residents. It lets a person reach active data brokers through a central request, without first compiling a list of every company that might hold their information.

Verify residency and provide matching details

Start at the official DROP website and complete the California residency check. Verification uses the California Identity Gateway. The residency check is separate from the profile information used to locate broker records.

Next, create the deletion profile. The required details are name, date of birth, and ZIP code. Optional information includes email addresses, phone numbers, mobile advertising IDs, connected TV identifiers, and vehicle identification numbers.

These extra details can help brokers locate records stored under different identifiers. Someone who has used several email addresses, for example, may be easier to match when those addresses are included. Optional identifiers are not a condition for submitting a request.

Submit the request and save the DROP ID

Review the details before submitting. The request covers current and future active brokers in DROP unless the consumer narrows it by excluding particular businesses.

The confirmation includes an eight-digit DROP ID for checking progress. Keep it private. The state’s consumer instructions explain how to review results and adjust broker selections.

Follow up when necessary

Consumers can update their profiles, including adding information that may improve matching. The DROP help page says updates are allowed once every 45 days. It also provides a recovery route for a lost DROP ID and a review process when residency verification fails.

Requests may be submitted for another eligible person in supported circumstances, such as by a parent for a child. Follow the platform’s authorization instructions and verify the residency of the person whose information is involved.

What Do DROP Results Mean, And How Long Does Deletion Take?

DROP does not promise immediate deletion. Different brokers can produce different results because they hold different records and may rely on different legal exceptions.

A shared identifier can complicate deletion. For example, when an email address belongs to several people, the broker may need to opt out the associated consumers rather than delete one person’s records based on an uncertain match.

“Record not found” is also not proof that a broker has never held information about someone. It may mean the supplied details were insufficient to connect the request to a record.

CalPrivacy says consumers may wait up to 90 days for status updates. Brokers must retrieve requests at least every 45 days, then process and report within 45 days of retrieval. The waiting time before retrieval and the processing period explain that consumer-facing estimate. It is not permission to wait another 90 days after downloading a request.

What Information Can DROP Delete, And What Can Remain?

Deletion can cover more than names and contact details. Broker records may include shopping habits, browsing activity, location information, and predictions about someone’s interests or circumstances.

CalPrivacy explains that inferences can also be personal information subject to deletion. Removing an email address while retaining the linked, non-exempt consumer profile would miss the purpose of the request.

However, DROP does not erase every trace of a person online. Information provided directly to a business through a first-party relationship falls outside this broker-deletion process. Certain public information and records protected by sector-specific exceptions may also remain.

Consider a shopper who gives a store an email address to receive order updates. A DROP request does not automatically delete that store’s customer account. If a broker later obtains the address and uses it in a commercial profile, the broker-held information may be subject to DROP.

The current Delete Act text also allows retention where specified CCPA exceptions apply, such as information reasonably needed for qualifying security purposes or legal obligations. Retained information must stay limited to the permitted purpose; it cannot simply return to marketing use.

For businesses, the practical task is to separate records by source and purpose. A broad label such as “needed for compliance” is less useful than a record of the specific exception, the affected information, and the reason retention remains necessary.

What Are The Key Deadlines And Recurring Duties?

The Delete Act took effect in stages. The main consumer and broker processing milestones are already active as of October 2026.

The agency’s data broker guidance distinguishes annual reporting from ongoing deletion. Completing registration does not satisfy the processing obligation.

Timing is especially important for new brokers. A business starting in 2026 generally first registers annually in January 2027. But a business starting after August 1, 2026 must create its DROP account before beginning operations and meet the applicable access and processing requirements. It cannot use next year’s registration date to postpone participation.

What Must Data Brokers Do To Comply?

Compliance needs a working process across legal, data, engineering, and operations teams. A policy statement alone cannot find records, remove them, or report the result.

Register and disclose data practices

The 2026 annual registration fee is $6,000, plus the applicable payment processing fee. Access fees apply in specified situations, including certain newly operating brokers. Each business entity operating as a broker needs its own account and must handle its applicable fees.

Registration includes disclosures about data practices. The original SB 362 framework was later expanded by SB 361, which added reporting about further categories of sensitive information, identifiers, and certain recipients of data.

This distinction matters when researching “California Delete Act SB 362.” The original bill explains the law’s foundation, but a current compliance review must also consider later amendments and implementing rules.

Retrieve, match, delete, and report

CalPrivacy’s broker processing instructions describe a recurring workflow: download the relevant deletion lists, standardize and hash local identifiers, match records, take the required action, and report each result.

Hashing transforms identifiers into values that can be compared without distributing the original plain-text details through those lists. The broker still needs accurate formatting and matching rules. A formatting error can prevent a genuine match.

Where a match exists, deletion covers associated non-exempt information, including inferences. Brokers must also direct relevant service providers and contractors to take the required action. Removing a record from one database is insufficient if covered copies remain with those parties.

The regulations clarify that simply signing in does not count as accessing DROP for this purpose. The broker must retrieve a consumer deletion list.

Prevent deleted information from returning to use

A completed request needs to affect future data intake. Brokers must continue checking new information and respect ongoing deletion and sale-or-sharing restrictions, subject to the law’s exceptions.

An operational approach is to maintain a minimal suppression record: enough information to recognize a protected consumer when a new file arrives. That record should support compliance, not become a new marketing profile.

Consider a broker that deletes a person from its main database, then imports a partner file containing the same person the following month. Without a check at import or before sale, the deletion work can be undone. Assigning ownership of that check is as important as assigning ownership of the first deletion.

Keep useful evidence and prepare for audits

Request records should make it possible to trace what happened: when a batch arrived, which systems were checked, what action was taken, and whether the status upload succeeded. These are practical controls for finding gaps before a deadline is missed.

Required public metrics include request counts and mean and median response times. Independent audits begin in 2028. Under the statute, audit reports and related materials must be retained for at least six years and supplied within five business days of a written agency request.

Technical teams should work from the current DROP integration documentation, which covers manual and API-based processing. Testing should include failed uploads and inconsistent identifiers, not only successful matches. A process that works for one clean sample can still fail on ordinary production data.

One useful internal review is to follow a sample request from receipt to completion. Can the team explain why a record was matched, which linked records were removed, and what happened to any exempt information? Can it show that the final response reached DROP? Where a supplier performs part of the work, the review should include that handoff.

Keep legal decisions separate from technical errors. A record retained under a documented exception is different from a record left untouched because a job failed. Reporting both as the same outcome hides the issue and makes later investigation harder. Clear ownership helps: one person may approve an exception, while another monitors processing failures and makes sure they are corrected.

How can online stores give customers more control with Consentik?

Reading about the California Delete Act may leave you wondering how to give customers more control over their data. Consentik helps online stores manage cookie consent and opt-out choices across Shopify, Wix, WordPress, and other websites through an embed script.

Alongside data sale opt-out controls, Consentik offers:

• Customizable banners that fit your store’s design.
• Tracking-script blocking and Google Consent Mode V2 to manage tracking based on visitor choices.
• GPC support and consent logs to handle browser privacy signals and record preferences.
• Location targeting and multilingual options to reach customers across markets.

Features vary by platform and plan. Consentik supports website consent management, while DROP requests require a separate process.

How Is DROP Different From CCPA Requests And Cookie Controls?

These tools solve related but separate problems. Choosing the correct route depends on where the information sits and what the consumer wants changed.

The California Attorney General’s CCPA guidance explains direct privacy rights and opt-out methods, including Global Privacy Control. Those mechanisms remain relevant even where a business is not a data broker.

For example, a consumer seeking deletion from a store they use should look at that store’s direct request process. Someone seeking removal from unfamiliar broker databases can use DROP. Adjusting a website’s cookie preferences does not itself send a deletion instruction to every broker that already holds information.

Likewise, installing a cookie banner does not register a broker, process DROP files, or maintain deletion records. Each part of the privacy program needs to address the activity it actually controls.

What Does The Delete Act Mean For Shopify Stores And Marketers?

A Shopify store is not automatically a data broker because it records orders, runs a loyalty program, or sends customer emails. The first step is to understand the data flow, not to choose a compliance app.

For a practical review, separate information received directly from customers from information purchased, licensed, or obtained elsewhere. Then document where each category goes and why. This makes it easier to identify ordinary service operations, advertising relationships, and possible broker activities.

Marketing teams using purchased audiences or enrichment services should ask suppliers concrete questions: Where did this information originate? Which privacy requests apply? How are deleted or opted-out records excluded from later deliveries? Who handles an issue when an outdated audience file has already been imported?

These questions are operational recommendations, not a claim that every buyer of marketing data must register. Buying information alone is different from meeting the legal definition of a broker.

Store tools also need accurate positioning. Fraud filters, age gates, and checkout rules may address separate store needs, but those functions do not establish Delete Act compliance. Avoid presenting an unrelated app as a replacement for determining legal scope or building a deletion process.

What Are The Penalties For Non-Compliance?

CalPrivacy lists two distinct Delete Act penalty categories: failure to register can result in $200 per day, while failure to delete as required can result in $200 per deletion request for each day of non-compliance. Relevant fees and investigation or administrative costs can also apply.

The per-request element makes a missed processing batch significant. As a simple illustration, 100 requests left unfulfilled for 10 days would produce a $200,000 calculation at that statutory rate. This is an arithmetic example, not a prediction of an enforcement outcome.

A calendar reminder is useful, but monitoring should also confirm that the work is finished. A downloaded file, completed deletion job, and accepted status report are different events. A team needs visibility into each one to understand whether its process actually met the requirement.

What Should Readers Do Next?

The California Delete Act gives residents a practical route to reach businesses they may never have known held their information. Eligible consumers can start with the official DROP platform, provide accurate matching details, and review the results when processing is complete.

For businesses, the next move is to establish whether their activities meet the data broker definition. Covered brokers need an ongoing process with a clear owner, reliable matching, and evidence of completed actions. Other businesses should keep managing their own privacy duties without assuming that DROP replaces them.

The useful question is whether a privacy request changes what happens to the person’s information. Registration, notices, and software should support that result all the way through the data lifecycle.