California's Delete Act Deletion Mandate Takes Effect, Putting Data Brokers on the Hook for $200-a-Day Fines
As of August 1, nearly 600 California-registered data brokers must start processing consumer deletion requests through the state's DROP platform or face uncapped $200-a-day fines.
Overview
California’s Delete Act moved into its enforcement phase on August 1, as nearly 600 registered data brokers became legally required to start processing consumer deletion requests through the state’s Delete Request and Opt-Out Platform, known as DROP, or face fines. Under the California Privacy Protection Agency’s rules, brokers must now access DROP at least once every 45 days to retrieve deletion requests. Under California Civil Code Section 1798.99.82, a broker that fails to comply is liable for “$200 for each deletion request for each day” it fails to delete the information, and California does not cap the resulting fines, meaning penalties can keep accumulating for as long as a broker stays out of compliance.
What We Know
DROP was built under SB 362, the Delete Act, signed by Governor Gavin Newsom on October 10, 2023. The California Office of Administrative Law approved the implementing regulations in November 2025, clearing the way for the platform to launch. The platform itself went live for consumers on January 1, 2026, letting any Californian submit a single request that reaches every registered data broker in the state at once. At launch, Newsom said in a statement that “your data should belong to you, and DROP will make that happen in one simple step.”
August 1 marks a separate, second deadline: the date data brokers themselves must begin actively working through the requests that have piled up. According to the CPPA, data brokers must access the platform’s “accessible deletion mechanism” at least once every 45 days to pull down new requests, and must complete the deletion within 90 days of receiving a request. More than 300,000 Californians had already submitted deletion requests as of late July, all of them now queued for processing.
State Sen. Josh Becker, who authored the bill, described its purpose bluntly: “I wrote it to help us reclaim control of our personal information. It lets us delete our information from these shadowy data brokers that collect our most personal information… The Delete Act is a one-stop shop. Sign up once. Delete your information from these folks.” Becker said nearly 600 data brokers were required to disclose their data registries and the types of information they collect ahead of the deadline, and pointed to the CPPA and the state attorney general as the enforcement backstop: “We gave power in this bill to the attorney general to go after people who don’t comply with the law.”
Registration itself is not free. Data brokers operating in 2025 or newly operating in 2026 had to register with the CPPA by January 31, paying an annual fee of “$6,000 plus an associated third-party processing fee for electronic payments,” before they could even begin downloading deletion lists in August. Registering late carries its own penalty: the same statute sets fines of “$200 for each day” of non-compliance for a data broker that fails to register at all.
The agency has not waited for August 1 to start enforcing the law. Its Data Broker Enforcement Strike Force, announced in November 2025, has already issued multiple penalties against brokers that failed to register at all. In December, the CPPA Board fined ROR Partners LLC, a Nevada-based marketing firm catering to fitness and wellness brands, $56,600 after finding the company had built consumer profiles from “billions of data points” covering more than 262 million Americans without registering. The Board’s decision stated: “A sale is a sale. A business cannot bypass the CCPA’s and the Delete Act’s requirements by selling personal information as part of a larger suite of products and services it offers.”
In January, the agency fined two more companies for the same failure to register: Rickenbacher Data LLC, doing business as Datamasters, $45,000, and S&P Global Inc. $62,600. The CPPA said Datamasters, a Texas-based firm, had been reselling names, addresses, phone numbers and email addresses of millions of people, including those with Alzheimer’s disease, drug addiction, and bladder incontinence, segmented by age, perceived race, political views and health-related purchases. Michael Macko, the CPPA’s head of enforcement, said “reselling lists of people battling Alzheimer’s disease is a recipe for trouble. In the wrong hands, these lists could be used to target people for more than just advertising.” S&P Global’s registration lapse, by contrast, stemmed from what the agency described as an administrative error; the company registered promptly once it discovered the mistake.
Privacy advocates and legal scholars say the law’s design — a single government-run deletion channel covering an entire state’s data broker industry — has no real precedent. Hayley Tsukayama of the Electronic Frontier Foundation said data brokers “make their money by collecting information from lots of different sources, sort of analyzing it, repacking it, selling it to other people,” adding that many people are “uncomfortable with the idea that somebody I don’t know is collecting information and repacking it.” Robin Feldman, a professor at UC Law San Francisco, said other states have tried different approaches, “but nothing’s got that knockout power like California, because now data brokers are required to follow. With the Delete Act, even if they don’t register in California, they’re still stuck with it.” Feldman also said the uncapped fine structure gives the law teeth: “It’s like a parking meter that keeps running, and they can multiply exponentially based on the number of data uses and the number of California citizens who are involved.”
The broker registry has grown steadily as enforcement has ramped up. IAPP reported that registered data brokers increased from 459 entities in June 2025 to more than 575 by February 2026, a trend CPPA Executive Director Tom Kemp linked to the agency’s broader profile, saying DROP “shows that California is the laboratory of democracy when it comes to consumer protection.”
What We Don’t Know
Neither the CPPA nor any of the outlets covering the deadline have published a real-time count of how many of the roughly 600 registered brokers accessed DROP or began processing deletions on or immediately after August 1. It is also not yet clear how the agency will prioritize enforcement among brokers that access the platform late versus those that ignore it altogether, or how quickly the Strike Force will move from registration-failure cases — its focus so far — to the newer deletion-processing violations the law also fines at $200 per request, per day.
Analysis
The law’s structure creates two distinct enforcement tracks that converge this month. One track, already active since late 2025, punishes brokers for never registering in the first place — the Datamasters, S&P Global and ROR Partners cases all fall here. The other track, activated by the August 1 deadline, punishes registered brokers for failing to act on deletion requests once they arrive. Because the per-day fine structure applies to both tracks without a cap, and because the CPPA has shown a willingness to pursue both small marketing firms and large, well-resourced companies like S&P Global, the coming weeks are likely to show whether the threat of accumulating fines is enough to drive the state’s data broker industry into compliance at scale — or whether enforcement remains concentrated on a handful of high-profile cases.