When does California Delete Act / DROP take effect?

California Delete Act / DROP took effect on Jan 1, 2024. The next milestone is Jan 31, 2027: Annual data broker registration deadline.

Who does California Delete Act / DROP apply to?

Data brokers: businesses that knowingly collect and sell to third parties the personal information of consumers with whom they do not have a direct relationship (Civ. Code 1798.99.80). No revenue or volume threshold.

What are the penalties under California Delete Act / DROP?

Administrative fines of $200 per day for failure to register, plus unpaid fees; $200 per deletion request per day for failure to delete as required by 1798.99.86; plus reasonable enforcement costs.

California Delete Act / DROP

In force California · In force Jan 1, 2024 · next deadline Jan 31, 2027 (in 3 months)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Coming up

ReportingJan 31, 2027 · in 3 months · Source

Annual data broker registration deadlineData brokers must renew registration with CalPrivacy by January 31 following each year they meet the definition.

ComplianceJan 1, 2028 · in 14 months · Source

Independent third-party audits beginBeginning Jan 1, 2028 and every 3 years thereafter, data brokers must undergo an independent audit of Delete Act compliance.

Already passed

ComplianceAug 1 · 3 months ago · Source

Data brokers must begin processing DROP deletion requestsBrokers must access DROP at least every 45 days, process verified deletion requests within 45 days, and treat unverified requests as opt-outs of sale/sharing.

ReportingJan 31 · 9 months ago · Source

Annual data broker registration deadlineData brokers must register with CalPrivacy and pay the annual fee ($6,000 for 2026) by January 31.

Takes effectJan 1 · 10 months ago · Source

DROP opens to consumersConsumers can submit a single deletion request to all registered data brokers through DROP.

Summaries for reference, not legal advice. Check the official text.

What it does

Requires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.

Who it applies to: Data brokers: businesses that knowingly collect and sell to third parties the personal information of consumers with whom they do not have a direct relationship (Civ. Code 1798.99.80). No revenue or volume threshold.
Penalties: Administrative fines of $200 per day for failure to register, plus unpaid fees; $200 per deletion request per day for failure to delete as required by 1798.99.86; plus reasonable enforcement costs.
Enforced by: California Privacy Protection Agency (CalPrivacy)
Official name: California Delete Act (SB 362, 2023), Cal. Civ. Code 1798.99.80 et seq., and DROP regulations
Citation: SB 362 (Stats. 2023, ch. 709); Cal. Civ. Code 1798.99.80-1798.99.89
Topics: Privacy, Data access and sharing

Verified 2026-09-22 leginfo.legislature.ca.gov cppa.ca.gov alston.com

Research notes

Registration fee reported to rise from $6,000 to $9,500 for 2027 (Alston & Bird, Aug 2026); not verified on cppa.ca.gov. Signing date Oct 10, 2023 per legislative history (chaptered as ch. 709).

EnactedAlabama

Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months

In forceArkansas

Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceCalifornia

California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026

In forceCalifornia

California ADS employment regulationsClarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.In effect since Oct 1, 2025

EnactedCalifornia

California AI Auditor RegistryCreates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.Next: Jan 1, 2027 Act takes effect · in 2 months

AmendedCalifornia

California AI Transparency Act (SB 942)Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.Next: Jan 1, 2027 Large online platform and hosting platform duties · in 2 months

In forceCalifornia

California AI autonomous-harm defense banA defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.In effect since Jan 1, 2026

Questions about California Delete Act / DROP

What are the California Delete Act / DROP compliance deadlines?: Jan 1, 2026: DROP opens to consumers. Jan 31, 2026: Annual data broker registration deadline. Aug 1, 2026: Data brokers must begin processing DROP deletion requests. Jan 31, 2027: Annual data broker registration deadline. Jan 1, 2028: Independent third-party audits begin.
When does California Delete Act / DROP take effect?: California Delete Act / DROP took effect on Jan 1, 2024. The next milestone is Jan 31, 2027: Annual data broker registration deadline.
Who does California Delete Act / DROP apply to?: Data brokers: businesses that knowingly collect and sell to third parties the personal information of consumers with whom they do not have a direct relationship (Civ. Code 1798.99.80). No revenue or volume threshold.
What are the penalties under California Delete Act / DROP?: Administrative fines of $200 per day for failure to register, plus unpaid fees; $200 per deletion request per day for failure to delete as required by 1798.99.86; plus reasonable enforcement costs.

Deadlines

What it does

Related