What California's Delete Act Means for Your Own Data Practices

California's DROP platform is now processing centralised consumer data deletion requests. Even if your organisation doesn't meet the technical definition of a data broker, this is a good, concrete prompt to review your own data handling practices — because the direction of regulatory travel is unambiguous.

First, Confirm Whether You're Actually a Data Broker

California's definition is broader than most organisations assume — if you sell, share, or license consumer personal information to third parties in any meaningful way, it's worth a real legal review rather than an assumption. Getting this wrong in either direction (assuming you're covered when you're not, or vice versa) has real cost.

What to Review Regardless of Your Broker Status

• Whether your organisation can actually fulfil a consumer deletion request end to end — across every system that holds their data, not just your primary database
• Whether your data retention practices are more expansive than what your actual business need requires — a common gap that becomes a compliance liability once regulation catches up
• Whether responsibility for privacy compliance sits clearly with someone, with a defined process, rather than being informally 'everyone's job' — which in practice means no one's
• Whether your vendor and data-processing agreements with third parties include the deletion and compliance obligations you'd need them to honour on your behalf

Why Get Ahead of This Now

Roughly 19-20 US states now have comprehensive consumer privacy laws, each with its own specific mechanics — and Washington state's own August 2026 report recommending broker registration suggests more states are converging on California's centralised-deletion model. Building genuine deletion capability once, well, is cheaper than retrofitting compliance state by state as more laws land.