California Data Broker Registration Law, as amended by the Delete Act (SB 362)

The most demanding data-broker regime in the country. Brokers register annually with the California Privacy Protection Agency by January 31 and disclose collection practices. The Delete Act's centerpiece — DROP, the state-run Data Broker Requests and Opt-Out Platform — went fully live for brokers on Aug 1, 2026: registered brokers must now check DROP at least once every 45 days, delete all matching personal information including inferences unless an exemption applies, and report each request's status back through the platform. A third-party compliance audit requirement follows. Non-registration penalties accrue at $200 per day.