On November 8, the California Privacy Protection Agency (CPPA) Board unanimously approved new regulations for data brokers, strengthening the Delete Act's provisions. The Delete Act, effective since January 2024, mandates that data brokers register with California and empowers consumers to request deletion of their personal data. The CPPA’s regulations clarify the law, broadening data broker definitions and simplifying terms for consumers and businesses.

Expanded Data Broker Regulations

Under the Delete Act, data brokers are defined as businesses collecting or selling consumer data without direct relationships with those consumers. The new regulations, however, clarify that even businesses with direct consumer relationships may be considered data brokers if they sell information from external sources. This expanded definition aims to close potential gaps in consumer data protection.

New Consumer Platform: DROP

The CPPA is also advancing a Delete Request and Opt-out Platform (DROP), which will allow consumers to make deletion and opt-out requests via a single, free platform starting in January 2026. DROP will enable consumers to securely request data deletion and will require data brokers to act on these requests within a 45-day cycle.