CA DROP enforcement starts August 1 — here's what $200/day looks like in practice
The CPPA just added enforcement teeth to the California Delete Online Personal Information Act. Starting August 1, 2026, any data broker that fails to complete a consumer deletion request within 90 days is on the hook for $200 per day, per unfulfilled request. The Data Broker Strike Force exists to pursue violators — not as a background threat, but as an active enforcement unit.
If you're a broker, you've had plenty of warning. If you're a consumer or a privacy-focused org helping individuals manage their exposure, the window to build a compliant deletion pipeline is right now.
What the portal actually does
The CPPA's DELETE portal is the official submission point. Consumers submit once; the CPPA routes deletion requests to registered data brokers. Brokers have 90 days. After that, the $200/day clock starts.
This is materially different from opt-out forms scattered across 400+ individual broker sites, each with their own process, captcha wall, and verification loop. The portal centralizes submission. It does not centralize verification, confirmation, or follow-up enforcement on the consumer's behalf.
Meaning: you submit, you wait, and if the broker doesn't comply, you have to know to file an enforcement complaint. Most people won't.
The gap the portal doesn't close
CA DROP covers registered California data brokers. The CPPA has a broker registry. What it doesn't cover is the secondary market — brokers who bought your data from other brokers, aggregators who don't meet the revenue threshold for registration, and offshore platforms that fall outside CCPA jurisdiction entirely.
The $200/day penalty is real leverage for the registered tier. The rest of the ecosystem operates outside it.
That's why automated, recurring deletion requests matter more than a one-time submission. Brokers re-populate records from aggregated transaction and credit data on roughly 90-day cycles — the same window CA DROP gives them to comply. Manual deletion keeps you clean for about one cycle. Automated deletion keeps you clean continuously.
The operational math
Forty-plus brokers at 5 tiers of exposure. Roughly 40 hours of manual time per year to maintain deletion coverage on the visible tier. The CPPA portal reduces that burden for the registered California brokers — and only those.
For anyone building a privacy practice, a compliance program, or simply trying to stay off data broker profiles without burning half a workweek on it, the math tilts quickly toward automation.
BizSuite's data removal service runs $497 one-time and $49/month ongoing — covers 40+ brokers across 5 tiers with SB 362 compliance baked into the request logic. CA DELETE Act requirements aren't an afterthought; they're the architecture.
August 1 isn't far. If you haven't built the pipeline yet, now is the time.
Top comments (0)