CPPA advances ‘DROP’ deletion platform to formal rulemaking; consumer access planned for Jan. 1, 2026

The California Privacy Protection Agency on March 7 voted 5‑0 to direct staff to begin formal rulemaking on the Delete Request and Opt‑out Platform, nicknamed DROP, authorizing a 45‑day public comment period and allowing staff to make non‑substantive edits required by the Administrative Procedure Act.

The vote follows an agency presentation on the DROP build, an update that the 2025 data broker registry went live Feb. 24 and public comment from businesses and privacy advocates about fees, registration and compliance burdens. "The 2025 data broker registry is live on the CPPA website," Chair Jennifer Urban said during her opening remarks.

Why it matters: DROP is a statutory, statewide mechanism created by SB 362 to let California residents submit a single verifiable deletion request that is routed to registered data brokers and their service providers. The platform is intended to make it easier for consumers to remove personal information and for the agency to monitor compliance; it will also create new operational obligations for data brokers, including annual registration and reporting, periodic deletion processing and independent audits.

Agency plan and timeline The CPPA said it signed an interagency agreement with the California Department of Technology (CDT) with an effective date of Jan. 1, 2025 and that CDT is constructing the DROP system. Staff said consumers will be able to submit deletion…