How the DELETE Act Works for California Residents

Maria in Sacramento started counting in March. By the end of the week she had logged 38 unsolicited calls. Auto-warranty renewals. Solar panel installers. Medicare supplement plans. A debt consolidation pitch in Spanish. Two health insurance “verifications” that wanted her date of birth. Her number was on the Do Not Call registry. Had been for years.

She had not given her number to any of these callers. They had it because data brokers had collected, packaged, and resold it across the consumer-marketing economy. Each spam call represented a record sale.

A friend mentioned a new California law. A single form, one website, and supposedly every broker in the state would have to delete her data. Maria looked it up. The law was real. The mechanism was SB 362 — the California DELETE Act — and the centralised deletion portal had gone live earlier that year.

What she did not know yet was how the law actually works, which brokers it covers, which brokers it misses, and what to do about the gap.

How do you file a DELETE Act request in California? Use the state’s DROP portal (Delete Request and Opt-out Platform) at the CPPA’s official site. Create a verified account with a California address, list the identifiers you want suppressed (name, emails, phones, addresses), and submit once. The CPPA forwards your request to every registered broker. Registered brokers must start processing requests from August 1, 2026. The portal is free, and it covers only the roughly 500 CPPA-registered brokers, so a separate CCPA request is still needed for the rest.

DELETE Act California: how to file, what it does

The DELETE Act is California Senate Bill 362, signed by Governor Newsom in October 2023. The full name is the California Delete Act, and the statutory citation is Cal. Civ. Code § 1798.99.86. It does one thing other US privacy laws do not: it gives California residents a single mechanism to request deletion from every data broker registered in the state, simultaneously, through one submission.

Before SB 362, exercising your CCPA deletion rights required contacting every broker individually. Hundreds of forms. Each broker has its own deletion process, its own verification steps, its own delays. Researchers at Consumer Reports documented in 2021 that successfully deleting data from a representative set of 240 brokers took an average of one hour per broker and a 50% failure rate even after follow-up. The math made full deletion impractical for a single person.

SB 362 was the legislature’s response to that math problem. Senator Josh Becker, the bill’s primary author, framed it as making the “patchwork unworkable” by collapsing it to a single portal. The deletion request goes to the California Privacy Protection Agency (CPPA). The CPPA passes it to every registered broker. Every registered broker must comply.

What the law requires of brokers

Three obligations matter.

Registration. Any business that meets California’s statutory definition of a data broker must register annually with the CPPA. That definition means a company that knowingly collects and sells the personal information of consumers it has no direct relationship with. The registration is public. The list lives at cppa.ca.gov and is searchable. As of mid-2026, around 500 brokers are registered. Each registration includes the broker’s name, point of contact, types of data collected, and the categories of consumers covered (including whether they collect data on minors, precise geolocation, or reproductive health data).

The deletion timeline. From August 1, 2026, brokers must retrieve the current request list from DROP at least every 45 days. Once a broker retrieves your request, it has 45 days to report what it did with it, and the full determination is due within 90 days. The law requires deletion of all personal information about the requesting consumer from the broker’s databases. It also requires ongoing suppression, meaning the broker cannot recollect the same data later without re-consent.

Recurring re-deletion. This is the part most summaries skip. Brokers must keep checking the request list every 45 days and re-delete any consumer record that has reappeared. This handles the case where a broker buys a new dataset that includes records about consumers who already requested deletion. The reappearance triggers automatic re-deletion. No new request from the consumer is required.

If a broker fails to comply, the CPPA can impose civil penalties of up to $200 per deletion request per day, plus injunctive relief. The fine structure is calibrated to make non-compliance more expensive than compliance.

How the deletion portal works

The CPPA-operated deletion mechanism is called DROP: the Delete Request and Opt-out Platform. It launched in stages. The first phase, public registration of brokers, has been live since January 2024. The second phase, the consumer deletion portal, went live on January 1, 2026. You can submit a request today.

One date matters here. Consumers can file now, but registered brokers are not legally required to start retrieving and processing DROP requests until August 1, 2026. For what that deadline does and doesn’t mean, see our DROP Act deadline guide.

To file:

1. Visit the CPPA’s official site (the URL is on cppa.ca.gov — be careful to use the .ca.gov domain, not lookalike commercial sites).
2. Create a verified account using a California address. The CPPA verifies residency before accepting deletion requests. Out-of-state residents cannot use the portal.
3. Provide the identifiers you want suppressed: name, email addresses, phone numbers, and physical addresses. The more identifiers you provide, the more matches across broker databases. Aliases and previous addresses matter — brokers index historical data.
4. Submit. The CPPA forwards the request to every registered broker.
5. Track. Brokers must report deletion completion through the platform. You can see compliance status per broker in your account.

The portal itself is free to use. No CCPA-style proof-of-residency notarisation. No paper forms. The verification step uses standard online identity proofing — government ID or address verification documents.

A request takes about 15 minutes to file. If you file before August 1, 2026, it simply waits in the queue until brokers are obligated to start retrieving requests. Compliance reporting then closes the loop over the following 90 days.

The 400-broker gap

Now the part the press releases gloss over.

Researchers at Privacy Rights Clearinghouse and Consumer Reports have catalogued data brokers operating in the United States. Their cross-referenced lists, combined with Vermont’s older broker registry and the LexisNexis-style B2B-only databases, push the realistic total of US-operating brokers above 900.

California’s registered list sits at around 500.

The math means around 400 brokers that demonstrably traffic in personal data about California residents are not currently registered with the CPPA — and therefore are not bound by DROP-mediated deletion requests. Some of these are small operations that may have slipped under the registration threshold. Others are companies that contest whether they meet the statutory definition of “data broker” and are arguing the point in regulatory correspondence. A non-trivial number are simply non-compliant.

The CPPA has begun publishing enforcement actions. The first wave in 2024 targeted brokers that had failed to register; fines have ranged from $7,500 to $46,000 per company. The agency has been transparent that registration enforcement is an ongoing process. The gap is closing, slowly.

For now, a DROP deletion request handles roughly half of the brokers that hold your data. The other half require separate, manual deletion under CCPA’s individual deletion right. That half includes people-search sites that argue they are “publishers” rather than brokers, lead-generation companies that argue they are “marketers,” and marketing-data aggregators with ambiguous corporate structures.

The DELETE Act does not preempt CCPA. You retain the full CCPA right to demand deletion from any business that holds your data, registered or not. The DELETE Act adds a centralised mechanism for the registered subset; it does not replace the individual right for the unregistered subset.

Who is required to register

The statutory definition matters because it determines the law’s reach.

A “data broker” under SB 362 is a business that knowingly collects and sells personal information about consumers with whom the business does not have a direct relationship. Three pieces matter:

The collection must be knowing — accidental aggregation through, say, a hosting provider does not count.

The data must be sold — which under California law includes exchange for any form of valuable consideration, not just cash. Data-for-services trades count. Data shared in exchange for analytics or marketing partnerships count.

The consumer must not have a direct relationship with the business. This is the carve-out that excludes consumer-facing companies. Your bank holds your data, but you have a direct relationship with it; it is not a broker under SB 362 even though it may sell de-identified or aggregated data. Your grocery store’s loyalty programme is not a broker. Facebook is not a broker for users with Facebook accounts.

The companies caught by this definition sit in the middle of the supply chain. They include aggregators, append providers, list rental companies, people-search sites, lead generators, ad-tech identity graphs, and the analytics firms that resell location, financial, or health-adjacent data.

You can check the CPPA registry to see who has registered and search for specific company names. Some recognisable broker brands are listed, including Acxiom, Epsilon, Experian’s marketing services arm, Spokeo, BeenVerified, and Whitepages.

Verifying compliance after you file

Once brokers begin processing (from August 1, 2026) and the reporting window passes, the portal reports per-broker status. The realistic outcomes:

Deleted. The broker has confirmed deletion and confirmed they have added you to their suppression list. The record should not reappear.

No record found. The broker did not have data matching your identifiers. This is common; most brokers do not have records on every Californian.

Partially complied. The broker deleted some matches but flagged others as exempt under the law’s research, security, or legal-compliance carve-outs. SB 362 includes the same exemptions CCPA does — data needed for fraud detection, legal compliance, security research, or certain regulated industries can be retained. You can challenge a partial compliance finding through the CPPA.

Non-responsive. The broker did not respond within the required window. The CPPA will flag the broker for enforcement review. This is rare among registered brokers; the financial penalty makes non-response uneconomic.

After the cycle completes, the recurring re-deletion obligation kicks in. You do not need to re-file. Brokers are required to keep checking your record against their inflows every 45 days, indefinitely, until you withdraw the deletion request.

What changes if your residency changes

This is the gap most consumers do not anticipate.

SB 362 protects California residents specifically. If you move out of state, the DELETE Act protections lapse for new data collected after your move. The existing deletion record persists, because brokers cannot re-add data they already deleted. But new data collected about you in your new state is governed by that state’s laws, or, in most US states, by no specific data-broker law at all.

If you split time between California and another state, the residency definition under the Revenue and Taxation Code applies. The CPPA uses a six-month physical-presence test. Snowbirds who spend more than six months elsewhere may not qualify.

If you move into California, your DELETE Act rights activate. You can file a deletion request from your first day of residency, though the CPPA’s verification step requires an established California address — typically a utility bill or lease agreement.

Texas, Oregon, and several other states have proposed similar broker-deletion laws. As of mid-2026, California remains the only US state with an operational centralised deletion portal. New York and Washington have bills in committee.

How the options compare

The manual route through the CPPA is free and effective for the ~500 registered brokers. DeleteMe automates a subset of US brokers. KnytX extends to the unregistered gap, international brokers, and people-search sites.

The CTA the law makes possible

KnytX free tier prepares a DELETE Act deletion request for you and walks you through submitting it. You provide your identifiers once; we handle the CPPA verification flow, prepare the request, and track the per-broker compliance reporting that comes back once brokers begin processing. The free tier handles SB 362-covered brokers. The Shield tier extends to the 400 unregistered brokers, the people-search sites, and the EU and India equivalents — using each jurisdiction’s own deletion mechanism for each broker.

You can do this manually. The portal is free, and the process is documented at cppa.ca.gov. Most people don’t, because of the gap-handling. The brokers that aren’t on the SB 362 list, the people-search sites that need separate CCPA requests, and the international brokers are the part that takes hours and recurs.

For the legal background on SB 362, exemptions, and enforcement structure, see the DELETE Act legal page. The product details on guided filing and tracking are on the DELETE Act product page.

What you can do right now

Walk through an example exposure report to see which broker sites can list your name, phone, and address. From there you can decide whether to file a DELETE Act request directly through CPPA, let KnytX prepare the filing and walk you through it, or do nothing and accept the level of exposure you have. KnytX Shield isn’t live yet; join the waitlist to run your own scan at launch.

The spam calls Maria was getting did not stop the day she filed. Once brokers begin processing requests, call volume typically tapers over the following weeks as your record propagates through broker suppression lists. In an illustrative case like hers, the volume might be down substantially within a few months. The remaining calls come from the unregistered brokers, the gap. Those require a different approach.

Related posts

• What CCPA Actually Gives You — and What It Doesn’t
• How to Remove Yourself from US Data Brokers
• How Scam Callers Know Your Name Before You Answer