CA DROP Enforcement Starts August 1: What the 90-Day Window Actually Means

California's Delete Request Optimization Portal went live January 1, 2026. For most businesses and individuals, it's been invisible. Starting August 1, that changes — data brokers who don't process deletion requests within the required window face $200 per request per day in penalties. 500+ registered data brokers must comply.

Here's what the timeline actually looks like if you're trying to get ahead of it.

What CA DROP Requires

CA DROP creates a standardized deletion pipeline. Registered data brokers must:

• Retrieve deletion requests from the portal every 45 days
• Complete deletion within 90 days of the request submission
• Maintain records of completed deletions

The CPPA created a Data Broker Strike Force specifically to pursue violators. This isn't a notification-only framework — the enforcement mechanism has teeth.

The $200/day penalty applies per unfulfilled deletion request. For a named individual with records across 50 registered brokers, a single non-compliant broker could run $7,300 in penalties over 90 days. Multiply that across an organization's personnel or a law firm's client base.

The Practical Problem with Self-Service Deletion

CA DROP standardizes the submission side. The fulfillment side — actually getting your data deleted and staying deleted — is a different problem.

Data brokers re-populate their records. A removal today doesn't prevent your information from re-appearing in a broker's database 60-90 days later when they refresh from upstream sources. CA DROP doesn't require brokers to suppress future re-ingestion of data they've deleted — only to honor deletion requests when filed.

For individuals (executives, founders, public figures, healthcare professionals) managing exposure across broker networks, the manual process of monitoring, re-filing, and tracking completion across 500+ brokers runs 40+ hours of work per cycle. The 90-day window means that's a recurring quarterly task.

Automated Removal vs. Filing Requests Manually

BizSuite data-removal covers 40+ brokers across 5 tiers — including the major networks feeding into CA DROP-registered brokers. It handles the submission cycle, tracks deletion confirmations, and monitors for re-population. CA DROP compliance is built in.

At $497 + $49/month, it's designed for the individual or small organization that needs automated coverage rather than a manual quarterly project.

August 1 is 51 days out. If you haven't started, the 90-day fulfillment window means you're already behind the enforcement curve for requests that should have been filed in early May: https://getbizsuite.com/data-removal.html