New DROP Requirements Raise the Stakes for Data Brokers Handling Californians’ Personal Information

Short summary

California's SB 361 expands the Delete Act, requiring registered data brokers to check the DROP database every 45 days starting August 1, 2026, and delete requested consumers' personal information within 45 days. Penalties reach $200 per day for registration failures and $200 per deletion request per day for non-compliance. Companies handling Californians' data should assess their data broker status, map data flows, and build documented DROP-check processes now.

• •Data brokers must check DROP every 45 days and delete requested data within 45 days starting Aug 1, 2026
• •Penalties: $200/day for registration failures and $200/deletion request/day for non-compliance
• •Companies should confirm data broker status, map CA data flows, and build vendor deletion processes

Generated with AI, which can make mistakes.