California's New Data Deletion Law Just Took Effect — It Could Cost You $200 a Day

Starting today, August 1, 2026, thousands of California data brokers have to start honoring deletion requests through the state's new centralized platform — or face a fine of $200 per request, per day. If your business ever sells customer lists, buys audience segments, or enriches marketing data with information from people you've never directly done business with, this deadline may apply to you, even if you've never thought of yourself as a "data broker."

What's Happening Today

California's Delete Act (SB 362) created a first-of-its-kind system called the Delete Request and Opt-Out Platform, or DROP, run by the California Privacy Protection Agency (CalPrivacy). DROP lets any California resident submit a single deletion request that reaches every registered data broker in the state at once, instead of contacting each company individually.

Consumers have been able to submit requests through DROP since January 1, 2026. But today, August 1, 2026, is the date data brokers are legally required to start retrieving and acting on those requests. Businesses that fall under the law's definition of "data broker" must now:

• Retrieve DROP deletion requests at least once every 45 days
• Match requests against their records using standardized identifiers
• Delete the consumer's personal information — including inferences drawn from it — unless a specific legal exemption applies
• Finalize each determination within 90 days of retrieving the request
• Document and retain records showing how each request was handled

On the consumer side, DROP works through an identity verification gateway, which consumers can access directly or through Login.gov, the federal government's identity verification service. Once verified, a consumer submits one request that CalPrivacy routes to every registered data broker in the state simultaneously — a meaningful shift from the old process, which required consumers to track down and contact each data broker individually, often with no guarantee of a response.

Who Actually Counts as a "Data Broker"?

This is the part that catches small business owners off guard. The law defines a data broker as any business that "knowingly collects and sells the personal information of a consumer with whom the business does not have a direct relationship." There's no revenue threshold and no small-business exemption written into the definition.

That means the label can apply well beyond companies that think of themselves as being in the data business. According to legal analysis of the rule, it can sweep in retailers that sell audience segments to brand partners, lead generation companies that build targeted lists from third-party sources, and marketing or analytics firms that sell "enrichment" data pulled from outside sources rather than their own customer relationships.

CalPrivacy has been explicit that businesses shouldn't assume they're exempt just because they're consumer-facing. If your business sells or shares personal information you didn't collect directly from your own customers — even as a side revenue stream — it's worth checking whether the Delete Act applies to you.

The Penalties Are Already Landing

This isn't a theoretical risk. In January 2026, CalPrivacy's newly formed Data Broker Enforcement Strike Force issued its first two penalties for failure to register as a data broker, months before today's deletion-processing deadline even arrived.

One company, Rickenbacher Data LLC (doing business as Datamasters), was fined $42,000 for buying and reselling personal information — including data tied to Alzheimer's disease, drug addiction, and other health conditions — for targeted advertising without ever registering as a data broker. The second, S&P Global, was fined $62,000 after CalPrivacy found the company had gone unregistered for 313 days, even though the agency treated the lapse as an administrative oversight rather than intentional evasion.

Those cases were about registration alone. Starting today, a second and separate penalty structure kicks in specifically for mishandling deletion requests: $200 per request, per day, for every day a data broker fails to act on a valid DROP request. For a business fielding even a modest volume of requests, that exposure can add up fast if deletion workflows aren't ready.

What This Means for Your Business

If you're not sure whether your business qualifies as a data broker, start with these questions:

Do you sell information you didn't collect directly?

If any part of your revenue comes from selling or sharing personal data about people who aren't your direct customers — purchased lists, appended data, audience segments sold to advertisers — you may be in scope.

Are you already registered with CalPrivacy?

Data brokers must register annually by January 31 and disclose the categories of data they collect. If you haven't registered and you meet the definition, that's the more urgent problem to fix, since registration penalties have applied since 2024.

Do you have a process to retrieve and act on DROP requests?

CalPrivacy provides an API and sandbox environment for engineering teams to connect to DROP. If your business handles any consumer data at scale, someone on your team — or an outside privacy counsel — should confirm your deletion workflow can meet the 45-day retrieval and 90-day determination windows.

Are you prepared for deletion requests from data broker partners?

Even businesses that aren't data brokers themselves may see an uptick in deletion requests flowing in from data broker partners who are now scrambling to honor their own DROP obligations.

Getting your business licensing and registration in order is a useful first step if you're not sure what regulatory filings already apply to your operation. And if you're still deciding how to structure a new venture that touches customer or marketing data, it's worth reviewing how LLC formation affects your liability exposure before data compliance issues like this one come up.

The Bigger Picture

California is currently the only state with a universal, centralized deletion mechanism like DROP, but it's not the only state watching data brokers closely. Texas, Oregon, and Vermont also require data brokers to register with their respective state agencies, and Connecticut just signed its own registration law in May 2026, with that requirement taking effect January 1, 2027. New Jersey, Delaware, Michigan, and Alaska are all developing similar frameworks. Businesses that operate across state lines should expect this pattern — registration requirements followed by centralized consumer request tools — to keep spreading well beyond California over the next few years.

For now, the immediate task for any business unsure of its status is simple: figure out today whether the Delete Act's data broker definition applies to you, not after a $200-a-day penalty clock has already started running.

A Quick Compliance Checklist for Today

• Audit your data sources. List every source of personal information your business uses in marketing, sales, or analytics, and flag any that didn't come directly from your own customers.
• Check your registration status. If you meet the data broker definition and haven't registered with CalPrivacy, treat that as the priority — registration penalties have applied since 2024, separate from today's deletion enforcement.
• Confirm your deletion workflow works end to end. A policy on paper isn't enough; someone needs to actually test retrieving, matching, and deleting a sample DROP request before the first 45-day window closes.
• Loop in your privacy counsel now. Because the data broker definition is broad and fact-specific, a short consultation is often the fastest way to get a clear answer instead of guessing.

Photo by Conny Schneider on Unsplash