California's Centralized Data Broker Deletion Platform Faces August Deadline
California's Delete Request and Opt-out Platform (DROP), created under the state's Delete Act, lets consumers submit a single deletion request that's honored across all registered data brokers rather than requiring a separate request to each one. Lawmakers have been tightening the system throughout 2026, with proposed legislation to shorten brokers' mandatory check-in cycle on the platform from 45 days to 30 days.
An August 1, 2026 deadline requires brokers to comply with expanded registration and disclosure rules under a law that mandates more detailed information about the personal data they collect — including whether it's sold to foreign actors, government entities, or generative AI developers, according to tracking from MultiState and the IAPP.
The California Privacy Protection Agency published an enforcement advisory noting that some data brokers may not be disclosing all of their trade names or associated websites on the state's registry, which the agency says makes it harder for consumers to identify who actually holds their data. The advisory warned that brokers must register independently rather than relying on a parent company's registration.
California's move follows its earlier rollout of mandatory risk assessments for high-risk data processing and new automated decision-making technology notice requirements, part of a broader expansion of the CCPA/CPRA framework through 2026.
For consumers, the centralized platform is meant to reduce the burden of manually contacting each broker — see our comparison of DIY versus paid data broker opt-out services for how it stacks up against third-party removal tools.
Sources: IAPP, MultiState.