Privacy & Information Security Law Blog

On March 7, 2025, the California Privacy Protection Agency (“CPPA”) voted to authorize the agency to advance proposed data broker regulations concerning the Delete Request and Opt-Out Platform (“DROP”) to formal rulemaking.

The CPPA’s proposed DROP regulations are part of the agency’s efforts to implement California’s Delete Act. The Delete Act requires the CPPA to establish an accessible deletion mechanism to allow consumers to request from registered data brokers the deletion of all non-exempt personal information related to the consumer through a single deletion request to the CPPA. The proposed DROP regulations coincide with the California AG’s enforcement sweep targeting the location data industry and recent enforcement activity by the CPPA against data brokers.

The accessible deletion mechanism provisions of the Delete Act apply to a data broker, meaning a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. Notably, the proposed regulations would change the definition of “direct relationship” to clarify that a business does not have a direct relationship with a consumer simply because it collects personal information directly from the consumer. Instead, to have a direct relationship with the business, the consumer must intend to interact with the business. Therefore, the revision would bring within scope of covered data brokers businesses that collect and sell to third parties the personal information of a consumer that did not intend to interact with the business.

The proposed regulations also clarify that a business is still a data broker and does not have a direct relationship with a consumer as to personal information it sells about the consumer that it collected outside of a “first party” interaction with the consumer. CPPA Board members indicated that these provisions are aimed to bring within the scope of covered data brokers third-party cookie providers with whom consumers do not intend to interact.

It is anticipated that DROP will be accessible to consumers by January 1, 2026, and to data brokers by August 1, 2026.