One request now reaches every registered California data broker

The revenue mechanism

Many small publishers monetize reader data indirectly, by allowing data brokers to buy, aggregate and resell audience segments built partly from their site's own tracking; California's Delete Act, signed 10 October 2023, changes that pipeline by giving residents one tool to shut it off across every registered broker at once. The bill's own text states it requires the California Privacy Protection Agency to establish, by 1 January 2026, an accessible deletion mechanism letting a consumer submit a single verifiable request that every data broker maintaining their personal information must honor, rather than the consumer contacting each broker separately as under the earlier CCPA framework.

What the documents show

The statute's text sets a specific operational timeline: the mechanism, which the CPPA calls DROP, was to be established by the Agency by 1 January 2026, and beginning 1 August 2026 every registered data broker must access DROP at least once every 45 days, process pending deletion requests, and then stop selling or sharing new personal information about that consumer going forward, with limited exceptions. The bill also requires data brokers to undergo an independent third-party audit starting 1 January 2028 and every three years after, reporting results to the Agency. The CPPA's own current page, retrieved 16 September 2026, states that as of 1 January 2026 California residents may use DROP to submit one request to all active registered data brokers, and that the platform is officially live.

The assumptions exposed

The deletion right applies only to brokers that have actually registered with the CPPA; a broker that fails to register is not exempt from the law but is also not necessarily reachable through DROP, a gap the statute addresses through separate enforcement rather than the deletion mechanism itself. A single DROP request stops a listed broker from selling or sharing new data about that consumer going forward; it does not retroactively undo audience segments or analyses a broker already sold before the request was processed. The August 2026 broker-processing deadline is later than the January 2026 platform launch, so an early request may not have been processed on the schedule the platform's availability suggests.

What to check before you rely on it

This is an editorial checklist. A publisher relying on data-broker relationships, directly or through a monetization partner, should check whether that broker appears on the CPPA's current registry, since deletion and audit obligations attach to registered brokers by name, not to every audience-data vendor by default.

• Is the data-monetization partner I use actually listed on the CPPA's current data broker registry?
• Does a DROP deletion request reaching that broker stop only new sales, or does it also affect data already sold to downstream buyers?
• Am I confusing DROP's January 2026 platform launch with the separate August 2026 date brokers were required to start processing requests?

The Delete Act builds a single deletion request across many brokers where none previously existed, but its own text ties that right to registration, timing and broker-side processing steps that a publisher's data partners may or may not yet satisfy.