California's DROP Platform Goes Live — First US Centralized Data-Broker Deletion Mechanism, 45-Day Check Cycle

confirmed Importance 7/10 ~2 min read 3 sources

California’s Data Removal Platform (DROP), the centralized deletion mechanism created by the Delete Act, became operational on August 1, 2026. Registered data brokers must check DROP at least every 45 days and process consumer deletion requests within 90 days, with per-request civil penalties for non-compliance that accrue independently and can exceed the liability for failing to register at all. A single consumer request now propagates to hundreds of registered brokers at once. It is the first centralized opt-out enforcement mechanism in the United States, arriving alongside a wave of state privacy laws — Connecticut, Arkansas, and Utah effective July 1; Indiana, Kentucky, and Rhode Island effective January 1.

The structural significance is the inversion of transaction costs. Every prior deletion regime required the individual to identify each broker holding their data and file separately, which meant the right existed on paper and almost never in practice — the asymmetry between one person’s time and hundreds of firms’ inertia was the entire defense. A centralized registry collapses that. The corpus has been tracking the state-level accumulation: New Jersey’s data broker law (2026-06-30–new-jersey-enacts-costliest-data-broker-law-a5328), Vermont’s Data Privacy and Online Surveillance Act (2026-06-16–vermont-data-privacy-online-surveillance-act-broker-deletion-rights), the FTC barring Kochava from selling sensitive location data (2026-05-07–ftc-bars-kochava-selling-sensitive-location-data-settlement). The unresolved question is the one that matters most for the capture beat: whether DROP reaches government purchasers of broker records or only commercial use. DHS buys location data from the same brokers (2026-08-12–brennan-center-dhs-29b-domestic-surveillance-architecture), and a deletion right that stops at the point of federal acquisition leaves the surveillance pipeline intact while giving consumers the impression it has been severed.

Sources & Citations

[1] Information for Data Brokers — California Privacy Protection Agency · Aug 1, 2026 Tier 1
[3] U.S. Privacy Laws That Take Effect in 2026 — Vault JS · Aug 1, 2026 Tier 2
Tiers Tier 1 court records & gov docs · Tier 2 established outlets · Tier 3 regional & specialty press · Tier 4 opinion or single-source. Methodology →
Cite this entry
The Cascade Ledger. “California's DROP Platform Goes Live — First US Centralized Data-Broker Deletion Mechanism, 45-Day Check Cycle.” The Capture Cascade Timeline, August 1, 2026. https://capturecascade.org/event/2026-08-01--california-drop-platform-live-first-centralized-data-broker-deletion/