Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
CPPA outlines DROP rollout, requires residency checks and stricter matching for bulk deletions
Summary
The California Privacy Protection Agency on Thursday described technical and regulatory changes to its Delete Request and Opt‑Out Platform (DROP), including residency verification and stricter hashed‑matching rules, and directed staff to publish revised text for a 15‑day public comment period.
The California Privacy Protection Agency on Thursday detailed changes to its planned Delete Request and Opt‑Out Platform (DROP), saying the portal will begin accepting consumer requests in 2026 and proposing tighter technical controls to avoid erroneous deletions.
At the board meeting, CPPA staff described system changes that include a requirement that the agency verify a consumer’s California residency before forwarding a bulk deletion request to registered data brokers, a prohibition on using partial hashed matches when multiple identifiers are combined, and new standards allowing data brokers to share suppression lists with their subcontractors so downstream vendors do not repopulate deleted records.
The modifications followed a 45‑day public comment period that produced about 176 pages of feedback from 19 commenters, according to staff. Staff said it would publish revised…
Already have an account? Log in
Subscribe to keep reading
Unlock the rest of this article — and every article on Citizen Portal.
- Unlimited articles
- AI-powered breakdowns of topics, speakers, decisions, and budgets
- Instant alerts when your location has a new meeting
- Follow topics and more locations
- 1,000 AI Insights / month, plus AI Chat
