Privacy Map

California. Data access / sharing. Act

Delete Act / DROPCalifornia Delete Act (SB 362, 2023; Cal. Civ. Code § 1798.99.80 et seq.)

In force

§1Summary

Synopsis

Requires data brokers to register annually with CalPrivacy and to process deletion requests submitted by consumers through a single state platform (DROP).

Key themes
  • data brokers
  • registration
  • single deletion mechanism
  • audits
Unique features

One request reaches every registered data broker; brokers must keep deleting new data about the consumer over time.

SaaS relevance

Caught only if the SaaS business sells data of consumers with whom it has no direct relationship; data enrichment and adtech vendors are most exposed.

§2Obligations

Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
$200 per day for failure to register; $200 per deletion request per day for failure to delete

§3Dates

Key dates
  • Adopted
  • In force
  • Data broker registry moved to CalPrivacy 2024; DROP opened to consumers January 2026; brokers must process DROP deletion requests from 2026-08-01 and at least every 45 days; independent audits from 2028.

§4Text and authority

Text
Authority
California Privacy Protection Agency (CalPrivacy)

§5Where it applies

Domestic law of
California

§6Sources and verification

Sources consulted
Verification

High confidence.

Penalty amounts from established knowledge.