California Delete Act (SB 362): The Complete Small Business Guide for 2026
What Is the California Delete Act?
The California Delete Act, formally known as SB 362, is a landmark privacy law that took effect in 2024 with enforcement beginning August 1, 2026. It created the Delete Request and Opt-Out Platform (DROP), a centralized system where California consumers can submit a single request to have their personal data deleted from every registered data broker in the state. Unlike previous privacy laws that required consumers to contact each company individually, DROP streamlines the process into one action. For businesses classified as data brokers, this means a new set of mandatory obligations including registration, periodic retrieval of deletion requests, and strict processing timelines.
Does Your Business Qualify as a Data Broker?
Under Civil Code section 1798.99.80(d), a data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. This definition catches more businesses than you might expect. If you purchase email lists, use data append services, operate a lead generation business, or aggregate consumer data from public and commercial sources for resale, you likely qualify. The key factors are: (1) you collect personal information, (2) from sources other than the consumer themselves, and (3) you sell or share that data with third parties. Common business types that qualify include lead generation agencies, people search websites, data enrichment services, marketing list providers, and ad tech companies.
Registration Requirements and Fees
Data brokers must register with the California Privacy Protection Agency (CPPA) before collecting or selling consumer data. The annual registration fee is approximately $6,600 per year. Registration requires disclosing your data collection practices, the types of personal information you handle, and your privacy policy. Failure to register carries its own penalties separate from the deletion request fines. The registration process is handled through the CPPA website, and businesses must renew annually.
The 45-Day Compliance Cycle Explained
Once registered and connected to the DROP portal, data brokers must retrieve consumer deletion and opt-out requests at minimum every 45 calendar days. Each request must be fully processed within that same 45-day window. Processing means searching all your systems for matching consumer records, deleting or anonymizing the data, notifying downstream vendors who received the data, and reporting the status back to the DROP portal. This creates a continuous compliance cycle that requires dedicated procedures, tracking systems, and staff coordination.
Fines and Penalties for Non-Compliance
The CPPA can levy fines of $200 per consumer deletion request, per day of non-compliance. To put this in perspective: if your business receives 100 deletion requests and fails to process them on time, that is $20,000 per day or $600,000 per month in potential fines. For larger data brokers receiving hundreds or thousands of requests, the exposure grows to millions. These fines are in addition to the penalties for failing to register as a data broker in the first place.
How to Get Compliant Before August 1, 2026
Compliance requires several concrete steps. First, determine whether your business qualifies as a data broker using the criteria above. Second, register with the CPPA and pay the annual fee. Third, connect to the DROP portal and set up your retrieval process. Fourth, create a complete data map documenting every system where consumer personal information is stored. Fifth, establish standard operating procedures for the 45-day cycle including internal deletion processes, downstream vendor notifications, and compliance logging. Sixth, update your privacy policy with the required DROP disclosure language. Finally, set up tracking and reporting systems for the mandatory January 31 annual filing.
Not sure if you qualify? Take our free Data Broker Risk Assessment to find out in 2 minutes.