California’s new Delete Request and Opt-Out Platform (DROP) goes live on August 1, 2026, and the compliance stakes are enormous. State officials have warned that a single missed deletion cycle could create theoretical penalty exposure of $1.5 billion for one data broker. That number reflects how aggressively the Delete Act is designed to work. One consumer request can now cascade across every registered data broker in the state, turning deletion compliance into a centralized, high-volume, enforcement-ready system.
The bigger surprise for many companies is not the platform itself—it is who may be covered. California is signaling that “data broker” should be read broadly, and the analysis turns on the data, not just the business as a whole. A company can have direct customer relationships and still be a data broker if it sells personal information obtained from third parties. If your business acquires consumer data indirectly and monetizes it, this is not a definition to skim past.
Operationally, DROP is not just a periodic deletion exercise. Registered brokers must access the system at least once every 45 days, pull hashed identifiers, match them against their records, process deletions, and report status before they can access the next batch. Even more important, unmatched identifiers still have to go on a permanent suppression list. That means if you buy relevant third-party data later, you may already be prohibited from selling or sharing it. Compliance is ongoing, and it reaches future data ingestion as much as current inventories.
Companies should now assess whether they have California data broker obligations, especially where third-party sourced data is involved. They should also be preparing for API integration, workflow design, suppression screening, and internal ownership before the August deadline arrives. California has built the system, consumers are already in the queue, and the window for treating DROP as a future problem is closing fast
