August 1, 2026 is a real regulatory deadline, and it’s getting confused with a different date that doesn’t exist: the day your data supposedly disappears. It isn’t that. Here’s what actually happens.
The one-sentence version
Starting August 1, 2026, every data broker registered with California’s Privacy Protection Agency (CPPA) must begin retrieving and processing deletion requests submitted through the DROP portal (Delete Request and Opt-out Platform). That does not mean anyone’s data is already deleted by that date, and it is not a one-time event. It’s the start of an ongoing, recurring obligation, not a finish line.
What “brokers must begin processing” actually requires
The statute — California Civil Code §1798.99.86, part of SB 362 (the DELETE Act) — sets three concrete obligations that kick in on August 1, 2026:
- Retrieve deletion requests at least every 45 days. Registered brokers have to pull the current list of deletion requests from the DROP portal on a recurring 45-day cadence, not just once.
- Report processing status within 45 days of each retrieval. A broker that pulls the list has 45 days to report back what it did with each request.
- Complete deletion determinations within 90 days. The full cycle — retrieve, process, confirm or contest — has a 90-day outer bound.
- Re-check on every subsequent retrieval. If a broker re-acquires data on someone who already filed a deletion request, it has to delete that data again on the next 45-day cycle, without the consumer re-filing.
Non-compliance carries a real penalty: up to $200 per consumer, per day, per violation, enforceable by the CPPA.
What August 1 does not mean
It does not mean your data is deleted that day. Nothing about the date guarantees your specific records disappear on August 1 or shortly after. If you file a DROP request before the deadline, brokers still get up to 45 days to retrieve it and up to 90 days total to complete the determination. Realistically, the first wave of confirmed deletions from requests filed around this date is expected in late fall 2026, not August.
It does not mean unregistered brokers are covered. DROP only binds brokers that registered with the CPPA. California’s registered-broker list runs to roughly 500 entities. Independent researchers estimate 900+ brokers actually operate in ways that meet SB 362’s definition. The gap isn’t touched by the August 1 deadline. It covers organizations that haven’t registered, are contesting whether they qualify, or are simply non-compliant. Big registered names like Spokeo, Whitepages, and Acxiom are in scope; many smaller and unregistered brokers are not. See our DELETE Act filing guide for the full registered-vs-unregistered breakdown.
It does not extend to other states. This deadline is specific to California Civil Code §1798.99.86. If you live in Texas, Oregon, Colorado, or anywhere else, this date has no direct legal effect on your data. Those states don’t have an equivalent centralized portal yet. A “your CCPA 45-day clock has started” message would be legally wrong for a non-California resident.
What you can do before the deadline
Filing before August 1 doesn’t get your data deleted faster than filing after. The 45/90-day clocks run from when a broker retrieves your request, not from the calendar date. What filing early does get you is queue position: your request is already waiting for the very first retrieval cycle once brokers are obligated to start pulling it. That beats joining a queue that may see a rush of first-time filers right around the deadline.
KnytX prepares the DROP filing package (the identifier set and CPPA-aligned consent) and walks you through submitting it yourself. There is currently no consumer- or agent-submission API, so we prepare it, you file it, never “we file it for you.” The filing itself is free on KnytX’s free tier, no card required. See DELETE Act Filing for the guided version, or the full legal mechanics if you want the statutory detail first.
A realistic timeline
- Now → August 1, 2026: Registration enforcement continues; brokers prepare their retrieval pipelines. Filing a DROP request now queues it for the first retrieval cycle.
- August 1, 2026: Registered brokers become legally obligated to start retrieving deletion requests at least every 45 days. This is a compliance start date, not a data-deletion date.
- ~Mid-September 2026 (45 days later): First retrieval-and-report cycle deadline for brokers that pull requests on August 1.
- Late fall 2026 (up to 90 days later): Realistic window for the first wave of confirmed deletion determinations to land, assuming no CPPA enforcement delays.
- Every 45 days after that: The recurring cycle — retrieve, process, re-check for re-added data — continues indefinitely. You do not need to re-file.
Frequently asked questions
Will my data actually be gone on August 1? No. August 1 is when the processing obligation begins, not a deletion date. Realistically expect confirmations to start arriving in the following months, not on the day itself.
Do I need to wait until August 1 to file? No — you can file today. Filing earlier just means your request is already queued when the retrieval obligation starts, instead of joining whatever volume of requests shows up right at the deadline.
What happens to brokers that aren’t registered? Nothing changes for them on August 1. DROP only reaches CPPA-registered brokers. Unregistered brokers require separate deletion requests under your general CCPA rights — see our DELETE Act guide for that gap in detail.
Is this the same deadline for every state? No. This is a California-specific statutory date under Civil Code §1798.99.86. No other state currently has an equivalent centralized deletion mechanism or deadline.
What if a broker misses the deadline? The CPPA can impose penalties of up to $200 per consumer per day per violation. As a filer, you’ll see non-responsive brokers flagged in your DROP account status; you don’t need to chase enforcement yourself.
What this page is not
This is not a promise that your data disappears on a specific date, and it’s not a substitute for the CPPA’s own guidance. Want the full statutory mechanics (who has to register, what counts as a “data broker,” what happens if you move out of state)? Read our complete DELETE Act filing guide. To see how much of your data is out there before you file anything, walk through an example scan →. It’s an interactive example report, not a live scan of your own data, but it shows exactly what a data broker exposure check looks for.
Statutory basis: California Civil Code §1798.99.86 (SB 362, the DELETE Act). Retrieval/reporting/determination cadence per the statute’s text; enforcement penalty figures per the CPPA’s public guidance.