California's DROP Portal Is Live. August 1 Is Not Optional.
The California Delete Act (SB 362) didn't just create new rules — it built the infrastructure to enforce them. The DROP portal went live January 1, 2026. As of that date, 545 data brokers registered and are now required to check the portal every 45 days, processing every deletion request they find.
The compliance window closes August 1, 2026. That's 49 days from today.
Here's what most people misread: the penalty isn't a warning letter. It's $200 per day, per deletion request that wasn't processed. If a broker misses 100 requests in a 45-day cycle, that's $9,000 in daily fines starting day one of non-compliance. With 545 registered brokers, the financial exposure scales fast.
Who's Actually in Scope
The law defines "data broker" broadly: any business that sells or shares personal information about consumers it didn't collect directly from the consumer. That includes people-search sites, marketing data resellers, background-check providers, and aggregators you've never heard of. If your personal information has ever leaked, been resold, or appeared in a Google results sidecard, some of those 545 brokers have it.
For individuals, the calculus is simpler: you have a legal right to have your data removed, and now the state has built the machinery to enforce it. You don't need to contact each broker manually — the DROP portal centralizes it. But the portal is designed for brokers to process, not for consumers to navigate. Most people won't interact with it directly.
What Actually Happens Without Help
Before DROP, the playbook was: go to each broker, find their opt-out page, submit your information, wait 30-45 days, check back, repeat every 90 days because the data comes back. With 545 registered brokers and more unregistered ones, that's hundreds of hours of work for a single person.
DROP changes the enforcement mechanism, not the volume of data. The brokers are now required to act — but they only process requests that get submitted through certified agents or the portal. The requests still need to be generated, tracked, and re-submitted on the 45-day cycle. That's the gap.
The Automated Approach
BizSuite's data removal service covers 40+ data brokers across 5 tiers, with built-in CA Delete Act (SB 362) compliance — meaning requests are formatted and re-submitted on the correct cycle, not just filed once. At $497 + $49/mo, it's the cost of maybe two hours of manual work per year, versus the ongoing drain of tracking it yourself.
The August 1 deadline applies to brokers, not consumers — but if you want the enforcement mechanism to actually work for you, your removal requests need to be in the system before brokers are required to process them.
Top comments (0)