California privacy rights: CCPA, the Delete Act and DROP

The CCPA protects California residents: natural persons who reside in California, even if temporarily outside the state. It applies to for-profit businesses that do business in California and have gross annual revenue of over $25 million, or buy, sell or share the personal information of 100,000 or more California residents or households, or earn 50% or more of annual revenue from selling residents' personal information. It generally does not apply to nonprofits or government agencies.

The Delete Act covers data brokers: businesses that knowingly collect and sell to third parties the personal information of consumers they have no direct relationship with. Brokers must register each year with the California Privacy Protection Agency (CPPA).

• Know what personal information a business collects, why, and who receives it.
• Delete personal information the business collected from you, with exceptions such as completing a transaction, security or a legal obligation.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your information, and limit the use of sensitive personal information.
• Non-discrimination for using these rights.

Data brokers usually hold information they did not collect from you directly. Through the Delete Act, a DROP request reaches every registered broker. A broker that has deleted your data must delete again at least every 45 days and must not sell or share new personal information about you unless you ask otherwise.

1. 1.For one business, use a request method listed in its privacy policy. It must offer at least two, such as a web form, email address or toll-free number, and may ask you to verify your identity.
2. 2.For data brokers, file one request at DROP. You confirm California residency, enter identifiers such as name, date of birth, email and phone number, and receive a DROP ID.

You may authorise an agent to submit CCPA requests for you. A business may require proof of your signed permission. The Delete Act requires the deletion mechanism to support authorised agents.

A business must respond to a verifiable request within 45 calendar days. It may take a further 45 days when reasonably necessary if it tells you within the first 45.

DROP opened on 1 January 2026. Since 1 August 2026, brokers must access it at least once every 45 days and process the deletion requests they find. The state says a status update can take up to 90 days. A broker that cannot verify a request must treat it as an opt-out of sale or sharing. First-party data, data exempt by statute and publicly available information are not covered.

The CPPA can fine a business up to $2,500 per violation, or up to $7,500 for intentional violations and those involving consumers it knows are under 16. A broker that fails to delete faces $200 per deletion request per day. You can complain to the CPPA or the Attorney General, though neither acts as your lawyer. Private lawsuits under the CCPA are limited to certain data breaches.

Biometric information used to establish identity is personal information, and processing it to uniquely identify someone makes it sensitive personal information. The exclusion for publicly available information does not cover biometric information a business collected about you without your knowledge.

The statute says personal information can exist in 'artificial intelligence systems that are capable of outputting personal information'. We have not found a regulation or court decision that settles what a deletion request requires for such a system.

A deletion request can reach stored data such as source images, dataset entries and profiles. It is not a way to remove a person from an already-trained model.