CPPA Opens Data Broker Registry and DROP Mechanism Comment Period

California's SB 362 Delete Act is the most significant privacy law in America due to its potential enforcement of the upcoming Delete Request and Opt-out Platform (DROP), and the California Privacy Protection Agency is giving you until June 10th to influence its impact. Here's the rulemaking info; https://cppa.ca.gov/regulations/drop.html

To recap, SB 362 includes the following in 1798.99.82.(d)(1); "An administrative fine of two hundred dollars ($200) for each deletion request for each day the data broker fails to delete information as required by Section 1798.99.86." For companies who are either not registered with the CPPA Data Broker Registry in 2026 (eg; ad/marketing agencies and ad networks), or do not fully comply with the DROP when it comes into effect in August, 2026, you could be facing the most significant 'administrative fines' that any U.S. governmental agency can directly levy on a business for a privacy violation. California residents will begin registering for the DROP in January, 2026 and total registrations could easily exceed 1mm participants by August, which could lead to a $200mm+ fine for unregistered data brokers as soon as September 15, 2026. 

If you need a reminder of the scope of the law and its potential regulation of any companies reselling third party data, or engaged in 'identity resolution' services, refer to this California Lawyers Association Privacy Journal Article.  In case you still don't think the law applies to your business, read this excerpt from the proposed revisions to the definition of 'data broker'; "A business does not have a “direct relationship” with a consumer simply because it collects personal information directly from the consumer; the consumer must intend to interact with the business." This reference clearly targets any companies collecting and/or selling or sharing data for targeted ads through third party pixel tags-cookies, mobile software development kits, or hashed emails/phone numbers from direct marketing lists.

If you'd like more info on how this could impact your business and potential issues you could highlight in public comments to the CPPA, please don't hesitate to connect/DM me.