On March 7, 2025, the California Privacy Protection Agency (“CPPA”) voted to authorize the agency to advance proposed data broker regulations concerning the Delete Request and Opt-Out Platform (“DROP”) to formal rulemaking.

The CPPA’s proposed DROP regulations are part of the agency’s efforts to implement California’s Delete Act. The Delete Act requires the CPPA to establish an accessible deletion mechanism to allow consumers to request from registered data brokers the deletion of all non-exempt personal information related to the consumer through a single deletion request to the CPPA. The proposed DROP regulations coincide with the California AG’s enforcement sweep targeting the location data industry and recent enforcement activity by the CPPA against data brokers.

The accessible deletion mechanism provisions of the Delete Act apply to a data broker, meaning a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. Notably, the proposed regulations would change the definition of “direct relationship” to clarify that a business does not have a direct relationship with a consumer simply because it collects personal information directly from the consumer. Instead, to have a direct relationship with the business, the consumer must intend to interact with the business. Therefore, the revision would bring within scope of covered data brokers businesses that collect and sell to third parties the personal information of a consumer that did not intend to interact with the business.

It is anticipated that DROP will be accessible to consumers by January 1, 2026, and to data brokers by August 1, 2026.