The CPPA Launches Preview of Statewide Data Deletion Portal (DROP)

On October 21, 2025, the California Privacy Protection Agency (CPPA) launched a webpage previewing the Data Rights Opt-out Portal (DROP), a tool designed to fulfill the California Delete Act’s mandate to create a centralized mechanism allowing consumers to request deletion of their personal information held by registered data brokers through a single submission to the CPPA. Under the Delete Act, “data broker” means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. According to the adopted regulations, a business does not have a “direct relationship” with a consumer simply because it collects personal information directly from the consumer; the consumer must intend to interact with the business.

The bottom line:
The CPPA aims for the DROP to become available to consumers by January 1, 2026, enabling streamlined deletion requests across all registered data brokers. Beginning August 1, 2026, data brokers must access the DROP every 45 days to retrieve and process new deletion requests, creating a recurring compliance obligation.

What you need to do:
Data brokers should review the CPPA’s DROP preview webpage to understand the upcoming requirements, evaluate internal systems for deletion readiness, and prepare workflows to ensure timely processing of requests once the portal goes live.
close
Loading...
Knowledge assets are defined in the study as confidential information critical to the development, performance and marketing of a company’s core business, other than personal information that would trigger notice requirements under law. For example,
The new study shows dramatic increases in threats and awareness of threats to these “crown jewels,” as well as dramatic improvements in addressing those threats by the highest performing organizations. Awareness of the risk to knowledge assets increased as more respondents acknowledged that their