The California Privacy Protection Agency on Thursday detailed changes to its planned Delete Request and Opt‑Out Platform (DROP), saying the portal will begin accepting consumer requests in 2026 and proposing tighter technical controls to avoid erroneous deletions.

At the board meeting, CPPA staff described system changes that include a requirement that the agency verify a consumer’s California residency before forwarding a bulk deletion request to registered data brokers, a prohibition on using partial hashed matches when multiple identifiers are combined, and new standards allowing data brokers to share suppression lists with their subcontractors so downstream vendors do not repopulate deleted records.

The modifications followed a 45‑day public comment period that produced about 176 pages of feedback from 19 commenters, according to staff. Staff said it would publish revised regulatory text and open a new 15‑day comment window so the public and registered brokers can review the proposed changes before the rules move to the Office of Administrative Law.

CPPA Executive Director Tom Kemp explained the tradeoffs the agency is trying to manage. "Californians want their personal information to be used only for the purposes they specify," Kemp said, noting the agency’s goal to balance robust privacy protections with technical safeguards to prevent fraud or mistaken deletions.

Staff said the system will accept multiple identifiers (for example, several email addresses or name spellings) to increase match rates, but clarified that when a consumer provides a combined deletion identifier set the platform will require a 100% match on that combined hashed value before ordering deletion. "This change reflects the functionality of the DROP system and minimizes the risk of erroneous deletions for data brokers," privacy fellow Gary Lee told the board.

Other clarifications in the draft text include standardized comparison rules for brokers to determine whether they hold a consumer’s data and a requirement that authorized agents may support a consumer’s DROP request only after the consumer’s residency has been verified. Staff also proposed status reporting so consumers can see whether brokers have matched, deleted, or declined to delete flagged records.

The board voted 5‑0 to direct staff to publish the modified text for a further comment period and to continue preparing the rulemaking package. The motion was made by Board Member McTaggart and seconded by Board Member Nonnecke.

Why it matters: DROP is intended to let Californians submit a single deletion or opt‑out request to multiple data brokers. The system’s design choices — how it matches consumers to broker records and how it prevents fraud or mistaken deletions — determine both how effective DROP is in practice and how many records brokers will have to flag or retain to satisfy subpoenas, investigations or legal exemptions.

What’s next: Staff will post revised text for a 15‑day comment period and said it will keep working with data brokers and technology partners to test hashing and matching approaches ahead of the law’s January 1, 2026, DROP launch. Staff also noted the statute requires audits of brokers in later years and that enforcement mechanisms remain part of the agency’s oversight toolbox.

Ending note: The board emphasized that the DROP rollout must protect Californians while avoiding technical designs that produce large numbers of false matches or deletions. The new text will return to the public and be updated again before final submission to the Office of Administrative Law.