From today, registered data brokers in California must process consumer deletion requests submitted through the Delete Request and Opt-Out Platform (DROP), under the Delete Act.
Key points
- Consumers can use DROP to ask all registered data brokers to delete their personal information in one request.
- Data brokers must access DROP at least every 45 days and process requests.
- Deleted consumers’ data must not be sold or shared in future.
- Independent compliance audits every three years begin in 2028.
UK organisations that sell or license data about California residents should check whether they are data brokers and, if so, be ready to process requests.
Source: DROP system requirements regulations (California Privacy Protection Agency)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
