DROP Deadline Tracker

Annual data-broker registration deadline

Data brokers must register with the California Privacy Protection Agency during the registration period, January 1–31 each calendar year. Failing to register carries an administrative fine of $200 for each day the business is not registered.

Source: 11 CCR § 7601(k) (registration period); Cal. Civ. Code § 1798.99.82(c)(1) ($200 per day)

Consumers can submit DROP deletion requests

Since January 1, 2026, California residents can use DROP — the Delete Request and Opt-out Platform — to send a single deletion request to every registered data broker at once.

Source: Cal. Civ. Code § 1798.99.86; CPPA, “Information for Data Brokers”

Brokers must begin accessing DROP and processing deletions

The statute is specific: “Beginning August 1, 2026, a data broker shall access the accessible deletion mechanism … at least once every 45 days.” On each access the broker must compare the consumer deletion list against its own records, delete all personal information associated with a matched identifier, and direct its service providers and contractors to do the same.

Source: Cal. Civ. Code § 1798.99.86(c)(1); 11 CCR §§ 7612–7613 (compare, delete, direct service providers)

Outer limit for a broker’s first DROP accessDerived

A broker that has not yet accessed DROP runs out of room 45 days after the August 1 start. This date is our arithmetic on the cited 45-day rule, not a deadline published by the Agency — you will see September 14 quoted elsewhere; neither date appears in the statute or the regulations. Treat mid-September as the outer limit and access earlier. A DROP account must exist before the first access, and the account must select every consumer deletion list that could match records the broker holds.

Source: Derived from Cal. Civ. Code § 1798.99.86(c)(1) (45 days from August 1, 2026); account and list selection per 11 CCR § 7610(a)

Rolling 45-day DROP access interval

The regulation states it plainly: “A data broker must access the DROP to download its selected consumer deletion list(s) at least once every 45 calendar days.” The interval runs from that broker’s own last access, not from a shared calendar date — after the first download, each later download returns only the requests received since that broker’s most recent one. At each access session the broker must also report the status of every request received during the previous session. Failing to delete carries $200 for each deletion request, for each day.

Source: 11 CCR § 7612(a), (c) (45 calendar days; incremental downloads); 11 CCR § 7614(a) (status reporting); Cal. Civ. Code § 1798.99.82(d)(1) ($200 per request per day)

New data brokers: 45 days from commencing operation

A business that starts operating as a data broker outside the January registration window must create a DROP account and begin accessing the platform within 45 calendar days of commencing operation, then register during the following January. The first-time access fee is on a sliding scale by month of first access — $6,000 in January down to $500 in December.

Source: 11 CCR § 7611(a)(1)–(3)