Cybersecurity Policy Report, Overview of Data Broker Opt-Out System Provided by California Privacy Agency, (Nov 12, 2025)

By Tony Foley

The California Privacy Protection Agency (CalPrivacy) has published its overview of the Delete Request and Opt-Out (DROP) system that the agency will launch in January 2026 after providing an update on the system at its Nov. 7 board meeting.

According to the overview, the DROP system enables California residents to submit requests to registered data brokers to delete their data and requires data brokers to register with the system. It provides information on the underlying legislation leading to the establishment of the DROP system, including the state’s broker registration law and the DELETE Act, which required CalPrivacy to develop an accessible deletion mechanism on its website to provide a “one-stop-shop” for consumers to file a deletion request to all registered data brokers.

The overview describes the DROP system experience for both consumers and data brokers. Specifically, consumers will be required to use a third-party ID verification to establish California residency and provide specified information related to the deletion request. Consumers will then submit the request for all or a subset of registered data brokers and are permitted to check the status of the request and to update it within 45 days of submission.

Brokers will be required to create an account in the DROP system and to complete registration, including submission of the annual registration fee, in January 2026. Every 45 days, data brokers must choose and download consumer deletion lists based on specific identifiers, identify any relevant matches, delete records and maintain a suppression list. Finally, brokers must report deletion status to consumers within 45 days of the request.

Brokers will be able to integrate an application program interface (API) into their systems beginning in spring 2026 and will download, process, and report status of deletion requests once every 45 days beginning Aug. 1, 2026.

The agency also announced last week that it would use name “CalPrivacy” going forward, in place of “CPPA,” to underscore its commitment to operationalize privacy rights and deliver clear consumer-friendly guidance to all Californians.

News: StateLegislation DataPrivacy CCPA