California's Delete Act Is Now Live — What DROP Actually Does

California's Delete Act (SB 362) and its centralised deletion platform, DROP, became operational August 1, 2026 — registered data brokers must now process consumer deletion requests submitted through DROP, with defined compliance timelines requiring status reporting within 45-90 days.

What Was Broken Before This

Previously, deleting your data meant opting out of each data broker individually — a process most consumers never completed, given there are hundreds of data brokers most people have never heard of. DROP centralises this into one request that reaches every registered broker, closing the practical gap between having a legal right to deletion and actually being able to exercise it.

Why This Matters Beyond California Consumers

• Any organisation that qualifies as a data broker under California's definition — which is broader than most companies assume — now has binding compliance timelines, not just a policy obligation
• This adds to an already expanding patchwork of state privacy law — roughly 19-20 US states now have comprehensive consumer privacy laws, each with its own specific mechanics
• Washington state separately released a report (August 14, 2026) recommending data broker registration requirements, suggesting more states are likely to follow California's centralised-deletion model rather than each building something bespoke

What to Check If You Handle Consumer Data

If your organisation buys, sells, or shares consumer data with third parties in any capacity, confirm whether you meet California's data broker definition and whether your DROP registration and deletion-processing obligations are actually in place — the compliance timeline is already running, not a future deadline to plan around.