The CPPA Launches Preview of Statewide Data Deletion Portal DROP

Kilpatrick Townsend


October 31, 2025 The CPPA Launches Preview of Statewide Data Deletion Portal (DROP) by Meghan K. Farmer , Tatum Andres On October 21, 2025, the California Privacy Protection Agency (CPPA) launched a webpage previewing the Data Rights Opt-out Portal (DROP), a tool designed to fulfill the California Delete Act’s mandate to create a centralized mechanism allowing consumers to request deletion of their personal information held by registered data brokers through a single submission to the CPPA. Under the Delete Act, “data broker” means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. According to the adopted regulations, a business does not have a “direct relationship” with a consumer simply because it collects personal information directly from the consumer; the consumer must intend to interact with the business. The bottom line: The CPPA aims for the DROP to become available to consumers by January 1, 2026, enabling streamlined deletion requests across all registered data brokers. Beginning August 1, 2026, data brokers must access the DROP every 45 days to retrieve and process new deletion requests, creating a recurring compliance obligation. What you need to do: Data brokers should review the CPPA’s DROP preview webpage to understand the upcoming requirements, evaluate internal systems for deletion readiness, and prepare workflows to ensure timely processing of requests once the portal goes live. ×

October 31, 2025 The CPPA Launches Preview of Statewide Data Deletion Portal (DROP)

On October 21, 2025, the California Privacy Protection Agency (CPPA) launched a webpage previewing the Data Rights Opt-out Portal (DROP), a tool designed to fulfill the California Delete Act’s mandate to create a centralized mechanism allowing consumers to request deletion of their personal information held by registered data brokers through a single submission to the CPPA. Under the Delete Act, “data broker” means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. According to the adopted regulations, a business does not have a “direct relationship” with a consumer simply because it collects personal information directly from the consumer; the consumer must intend to interact with the business.

The bottom line:
The CPPA aims for the DROP to become available to consumers by January 1, 2026, enabling streamlined deletion requests across all registered data brokers. Beginning August 1, 2026, data brokers must access the DROP every 45 days to retrieve and process new deletion requests, creating a recurring compliance obligation.

What you need to do:
Data brokers should review the CPPA’s DROP preview webpage to understand the upcoming requirements, evaluate internal systems for deletion readiness, and prepare workflows to ensure timely processing of requests once the portal goes live.