California Delete Act Compliance After August 1, 2026: What Data Brokers Should Be Doing Now

Corodata TeamOct. 20, 2026 | Compliance |

The California Delete Act (SB 362) gives consumers more control over how data brokers share and use their data. It allows residents to submit an information removal request through the Delete Request and Opt-Out Platform (DROP), which data brokers must act on.

DROP first opened for submissions on January 1, 2026. Since then, over 475,000 California residents have requested deletion of their personal information. But data brokers weren’t required to process and remove data until August 1, 2026. Now that the date has passed, qualifying data brokers must follow the legal guidelines.

California Delete Act compliance is ongoing, not a one-and-done action. In this guide, we explain what businesses are affected, the implications of the August 1 deadline, and how to stay compliant during each DROP cycle.

Table Of Contents:

What Changed on August 1, 2026?

On August 1, 2026, California began requiring data brokers to access the DROP system and process consumer removal requests. Under the California Delete Act (SB 362), data brokers must:

  • Access the DROP system at least once every 45 calendar days
  • Download deletion lists that apply to the personal identification identifiers they store and use
  • Match California data broker deletion requests against their records
  • Process deletion, opt-out, exemption, and “not found” actions
  • Report the status of each request through the DROP system

DROP access, downloads, and removal processes follow a continuous cycle. Once an organization accesses and downloads a removal list, it has 45 days to report on request statuses. Data brokers must also download the next list within 45 days of the previous download. 

First, Confirm Whether Your Business Is Actually a Data Broker

DROP rules do not apply to every company that follows the California Consumer Privacy Act (CCPA). They apply exclusively to data brokers, which California defines as “a business that knowingly collects and sells the personal information of a consumer with whom the business does not have a direct relationship.” 

The legal data broker definition does not include:

Questions businesses should revisit

If you’re unsure whether your organization falls under the California data broker definition, discuss these questions with your team:

  • Does our business acquire a consumer’s personal information from third parties?
  • Do we sell acquired consumer information to other companies?
  • Do we refine the data we collect with information obtained from other organizations?
  • Do any of our subsidiaries or legal entities participate in data broker activities?
  • Do we believe that a direct customer relationship exempts all of our data activities?

Document answers to this scope analysis in case relevant stakeholders ask about them. Avoid relying on assumptions made before DROP and the new 2026 regulations took effect.

Instead, review the new laws and keep them in mind during your team’s analysis.

Make DROP a Recurring 45-Day Compliance Process

You’ve done the analysis and believe the California Delete Act applies to your business. Now, you’ll need to create a few new workflows to support SB 362 compliance. 

Step 1: Download the correct consumer deletion lists

You can access deletion lists through the DROP system. They’re organized by different consumer identifiers, including:

  • Email
  • Telephone number
  • Mobile advertising ID for smartphones and tablets
  • Smart TV connected TV IDs
  • Name plus date of birth and ZIP code
  • Name plus vehicle identification number (VIN)

Choose lists that include identifiers you collect. For example, if you track mobile advertising IDs, phone numbers, and email addresses, download the applicable lists that contain them.

In limited circumstances, you may reduce the lists you collect for overlapping data. 

Step 2: Standardize and hash internal identifiers

The California Privacy Protection Agency (CPPA) converts every consumer identifier to an SHA-256 Base64 hash format. So, instead of seeing a list of email addresses or telephone numbers, you’ll get a CSV file of hashed values that resemble gibberish. 

The hash format makes it impossible to perform a simple V-lookup against your data. Instead, convert your identifiers to the same hash format before comparing them. 

You can find a full list of technical details on the CPPA website. It covers all the requirements you need, including formatting, standardization, hashing, API integration, validation, retries, and status codes.

Review the documentation early so you can build the right processes into your engineering and data management workflows. This saves your team time and gets you aligned with data broker deletion requirements. 

Step 3: Match and process each request

After downloading identifier lists and converting your own data, you’ll compare the hashed records. Outcomes fall into three categories:

  • Matched data: Delete all non-exempt personal information, including any associated inferences. You must also instruct service providers and contractors you work with to remove matching records.
  • Matched data with multiple consumers: If a single match involves two or more consumers, opt each individual out of data sales and sharing. Notify service providers and contractors to opt them out as well.
  • No match: Keep a list of consumers who requested data removal through DROP. Before selling or sharing data, compare their information against your retained records to make sure it’s removed going forward.

Step 4: Report the request status

The California Delete Act of 2026 requires data brokers to report their findings within 45 days of downloading a report. Categorize data for each removal request into one of the following statuses:

  • Deleted: You found a match and removed non-exempt information associated with the individual.
  • Opted out: You found multiple consumers linked to a single identifier and opted them out of data sales and sharing.
  • Exempted: You located a match, but the associated information is exempt. 
  • Not found: No match was found for the consumer’s identifier in your records.

Deleting the Record Once Is Not Enough

You completed round one of processing customer removal records from your organization’s data. Does that mean you can forget about their request in the future?

Not at all. California DROP requirements are an ongoing obligation. Once a consumer requests data removal, you’re responsible for deleting that data if it reappears in information you collect later. 

To comply with the California Delete Act requirements, you’ll need to retain enough information to continue checking the consumer’s identifiers against your records. This is sometimes called a suppression list. 

Before selling any data, compare it against your suppression list to ensure it includes no suppressed identifiers. Avoid repurposing the data, as this can land your business in legal hot water.

Compliance question: If you remove a consumer today and reacquire the same person’s data from a different source three months later, will your systems recognize the prior DROP request?

If the answer is no, revisit your existing data collection and removal workflows. California data broker compliance is an ongoing requirement, and you must ensure a consumer’s data is not shared or sold after they submit a removal request. 

Review Service Provider and Contractor Workflows

Many companies rely on third-party software, vendors, contractors, and other entities to store or retain customer data. SB 362 compliance doesn’t stop with your own records. It directs organizations to notify their service providers and contractors to also delete the data or opt out the individual.

Examples of documents and systems that can help you identify relevant third parties include:

  • Data processing agreements
  • Vendor inventories
  • Downstream databases
  • Cloud systems
  • Audience platforms
  • Enrichment providers
  • Data warehouses
  • Archived systems
  • Contractor deletion processes
  • Confirmation and audit trails

Remember, deletion workflows are only as reliable as the systems and vendors they reach.

Determine Whether Manual Processing Is Still Sustainable

The CPPA allows data brokers to use manual or automated processing methods. Its technical documentation includes API support and a sandbox for testing integrations.

The decision about which method to use ultimately depends on your organization. If your business qualifies as a data broker but handles minimal consumer information, manual methods may be suitable. However, organizations that handle a substantial amount of data may prefer automated techniques that reduce the risk of missed removals, incorrect matching, or reporting errors.

Controls that can assist your business with fulfilling California data broker requirements include:

  • Automated DROP retrieval
  • Scheduled processing jobs
  • Error monitoring
  • Retry handling
  • Data-store orchestration
  • Vendor notifications
  • Response-code validation
  • Escalation procedures
  • Compliance dashboards

Document Exceptions Instead of Treating Them as Blanket Exemptions

The California Delete Act of 2026 includes certain exceptions and exemptions that your business may qualify for. Investigate these exceptions and define how they apply to your workflows.

If you decide to retain a consumer’s information because it’s not legally necessary to remove it, document why. Have a process in place that shows how you identify exemptions, restrict how you use the saved data, and record the proper status in your reports.

In cases where you retain a significant number of removal exceptions, speak with qualified privacy counsel. They can confirm that your legal interpretation is accurate and that your recordkeeping and reporting methods align with the law.

Understand the Cost of Missing a Request

DROP compliance isn’t something you want to ignore. Doing so can lead to hefty fines, including:

  • $200 per day for each day a consumer’s deletion request goes unaddressed
  • Additional fees charged by the CPPA for investigation and administrative action

Let’s say your organization collects thousands of consumer data points from Smart TV identifiers. If 400 people submit a qualifying removal request, and you let it slide for 90 days, your business may face a minimum daily fine of $80,000 (400 valid requests x $200 per day). That equates to $7.2 million over the full 90-day timeframe.

The Delete Act also imposes a $200 per day fine for failing to register as a data broker, plus associated administrative fees. So, if you’re unsure whether you meet the requirements, now is the time to find out. Proper registration can help you avoid unnecessary fines.

Don’t Forget the Other Delete Act Obligations

This article covers the main impacts associated with the August 1, 2026, deadline for accessing, processing, and reporting removal requests. But your organization may have other California Delete Act compliance requirements, including:

  • Annual registration: If your organization meets the definition of a data broker, you must enroll with the California data broker registry and pay a fee. Registration is required annually by January 31 for activities from the previous year. In 2026, the registration fee was $6,000. Companies that begin data broker activities later in 2026 may pay a prorated fee based on the month they start operating.
  • Annual disclosures: Data brokers are required to update the privacy policy on their website that identifies the information they collect. They must also share a basic report of the removal requests they processed and the mean and median number of days they took to fulfill those requests. Disclosures are required by July 1 of the following year that they first qualify as a data broker.
  • Independent audits: Starting January 1, 2028, data brokers must undergo a third-party audit to determine whether they comply with the California Delete Act. Audits are required every three years.

As the California Delete Act evolves, your business may need to adhere to additional regulations.

Download the Hybrid Records Management Checklist

What Businesses Should Do Now

California privacy compliance in 2026 starts with clear planning. Use this framework as a guideline to structure your organization’s processes under SB 362.

Your checklist: A framework for California Delete Act compliance

  • Walk through the data broker definition guidelines for each business entity under your organization to determine whether it qualifies as a data broker.
  • Verify that required entities have an active DROP account.
  • Confirm that you’ve completed the registration process and paid any applicable fees.
  • Assign ownership of the rolling 45-day process to employees who are familiar with and can fulfill the matching, reporting, and notification process.
  • Verify that you’re pulling the proper DROP deletion lists. These should correspond with the identifiers you collect and share.
  • Validate that your identifier normalization and hashing is in line with the CPPA’s. 
  • Use a sandbox to test matching logic across your relevant databases. 
  • Verify that deletion includes associated records as well as the original source records. 
  • Map out service providers and contractors that should receive deletion or opt-out notifications.
  • Create a suppression list or ongoing-request mechanism to prevent a removed individual’s data from re-entering your files.
  • Verify that DROP status reporting is handled within the required 45-day timeline.
  • Monitor failed downloads, API errors, and processing exceptions.
  • Store evidence that identifies when removals are retrieved, processed, and reported.
  • Meet with qualified privacy counsel to confirm which claimed exceptions and exemptions apply to your business.
  • Start assembling relevant documentation to support future 2028 audit requirements. 

The Bigger Lesson: Delete Act Compliance Is Now a Data-Lifecycle Issue

Complying with SB 362 starts with registration and pulling relevant removal requests. But those are the easiest tasks. You’ll face more difficulty when creating a repeatable system that:

  • Identifies consumers across fragmented datasets
  • Deletes relevant records, including associated information that isn’t part of the original identifier
  • Notifies downstream vendors and contractors who have access to the consumer’s data
  • Prevents the reacquisition or resale of data in future datasets
  • Documents exceptions and why they’re excluded under the California Delete Act
  • Demonstrates how your process continues to work on an ongoing basis and complies with deadlines

Organizations that recognize DROP as part of their broader privacy and data governance architecture are better positioned for these changes than businesses that view every 45-day cycle as an isolated compliance activity.

If you’re unsure whether your business qualifies as a data broker or has the right framework in place to support the California Delete Act, take action now. Check your data flows, review deletion processes, and analyze vendor relationships to understand where you’re ready and where things could use more finessing. 

Getting on top of DROP integration now can help you avoid mistakes that lead to costly fines.

Frequently Asked Questions

Does the California Delete Act apply to every business?

California Delete Act compliance only applies to companies that meet California’s legal definition of a data broker. To determine whether your business qualifies, evaluate how you collect and sell data. If you’re unsure about your compliance requirements, consider consulting a privacy attorney. 

What happened on August 1, 2026?

On August 1, 2026, California started requiring data brokers to log in to DROP and retrieve removal requests. Obligated organizations must process requests, remove relevant consumer data, and report their findings. Platform access is required once every 45 calendar days.

How often must data brokers check DROP?

Data brokers must check DROP at least once every 45 days. Subsequent downloads should occur within 45 days of the previous download. 

Does a data broker have to delete information held by vendors?

Data brokers aren’t responsible for deleting information that a vendor holds. However, they must notify vendors and contractors who house personal information so that they can take the relevant action. 

What happens if no matching record exists?

Brokers must report all non-matching records as “not found.” They should maintain a suppression list and honor removal requests if a consumer’s data is acquired again in the future.

What are the penalties for violating the Delete Act’s deletion requirements?

Data brokers may incur a $200 daily fee for failing to delete a consumer’s information after a removal request. Other fines for administration and investigation may apply. 

Are audits required?

Beginning on January 1, 2028, data brokers must undergo an independent, third-party audit to verify that they’re in compliance with the California Delete Act. These audits will occur every three years. Additional regulations may crop up as the law evolves.