The DROP Compliance Index
Updated October 9, 2026. See Methodology below for sources and refresh cadence.
A standing, citable reference for California's Delete Act and its Delete Request and Opt-out Platform (DROP): how many brokers are registered, how many deletion requests have moved through the system, what the state has fined so far, and what's still ahead on the calendar. Every figure below carries a source and an as-of date. Link directly to this page, or to the section anchors, for a stable citation.
The enforcement tracker
Every CPPA data-broker enforcement action since the agency's first case in November 2024, in order, with the running total. Background Alert is listed but adds $0 to the total: it chose to shut down through 2028 rather than pay its $50,000 fine, which is why the agency's own public figure for the first 11 actions ($492,000) excludes it.
| Company | Date | Amount | Violation type | Running total |
|---|---|---|---|---|
| Growbots | 2024–2025† | $35,400 | Registration failure | $35,400 |
| UpLead | 2024–2025† | $34,400 | Registration failure | $69,800 |
| Infillion | 2024–2025† | $54,200 | Registration failure | $124,000 |
| The Data Group | 2024–2025† | $46,600 | Registration failure | $170,600 |
| KMA | 2024–2025† | $55,800 | Registration failure | $226,400 |
| National Public Data | 2024–2025† | $46,000 | Registration failure | $272,400 |
| Background Alert | Feb 27, 2025 | Shutdown | Registration failure — elected to shut down through 2028 rather than pay a $50,000 fine | $272,400 |
| Accurate Append | 2024–2025† | $55,400 | Registration failure (missed the Jan 31, 2024 deadline) | $327,800 |
| ROR Partners | Dec 3, 2025 | $56,600 | Registration failure — undisclosed data sales inside a marketing package (“a sale is a sale”) | $384,400 |
| Datamasters | 2024–2025† | $45,000 | Registration failure, plus a data-sale ban | $429,400 |
| S&P Global | 2024–2025† | $62,600 | Registration failure | $492,000 |
| LocateSmarter, LLC | Aug 11, 2026 | $116,490 | Registration failure + CCPA data-minimization violation — first action under both the CCPA and the Delete Act | $608,490 |
| Cybba, Inc. | Aug 13, 2026 | $52,400 | Registration failure | $660,890 |
| SalesIntel Research, Inc. | Aug 27, 2026 | $36,400 | Registration failure (unregistered Feb 1 – Jun 29, 2025, before timely registering in 2026) | $697,290 |
| 14 actions (13 monetary, 1 shutdown-in-lieu-of-fine) | $697,290 | |||
† Exact filing date pending confirmation against the individual stipulated order. CPPA's published enforcement window for the first 11 actions is November 2024 to January 2026; this table will be updated with confirmed dates as each order is cross-checked. Verified dates: Background Alert (cppa.ca.gov, Feb 27, 2025), ROR Partners (cppa.ca.gov, Dec 3, 2025), LocateSmarter (privacy.ca.gov, Aug 11, 2026), Cybba (gov.ca.gov, Aug 13, 2026), SalesIntel Research (privacy.ca.gov, Sep 1, 2026, order signed Aug 27, 2026).
Registry statistics, 2024
Every one of California's 603 registered brokers discloses, in its own annual filing, how many CCPA deletion requests it received directly in 2024 and how many it granted, partly granted, or denied. These figures are computed from the full 603-row registry filing, not a sample. This is category-level aggregation only: individual filings are public record, but this page never spotlights a single named firm's numbers.
Note the distinction from the 500,000+ figure above: that number is Californians enrolled in the statewide DROP platform, which only went live August 1, 2026. The numbers below are each broker's own direct CCPA deletion-request handling for 2024, reported in the 2026 registration filing, before DROP existed.
Denial-rate distribution
Among the 439 brokers that reported at least one 2024 deletion request. The registry-wide denial rate (1.5%) is pulled down by a handful of very high-volume filers; this distribution shows how denial rates actually spread across firms.
| Denial rate | Brokers | Share |
|---|---|---|
| 0% denied | 273 | 62.2% |
| Over 0%–25% denied | 83 | 18.9% |
| 25%–50% denied | 24 | 5.5% |
| 50%–75% denied | 13 | 3.0% |
| 75%–under 100% denied | 32 | 7.3% |
| 100% denied | 14 | 3.2% |
13.4% of brokers with at least one 2024 request (59 of 439) denied more than half of what they received. Complied-in-whole, complied-in-part, and denied sums run about 0.1% higher than the reported "total requests received" column across all 603 filings, a normal artifact of self-reported data rather than a computation error here; see Methodology.
The compliance calendar
Four dates that define the current DROP compliance cycle, from the deletion obligation that just started to the audits that will eventually check how it was run.
- Aug 1, 2026: registered brokers must access DROP and delete matching consumer records at least every 45 days, an obligation that repeats indefinitely (Civ. Code §1798.99.86(c)).
- Aug 6–7, 2026: the CPPA board advanced draft audit regulations (new Article 5, §§7630–7633) to formal rulemaking, opening a 45-day public comment period. This is draft text, not an adopted rule.
- Jan 1–31, 2027: the annual registration fee rises from $6,000 to $9,500 for that registration period, adopted at the same Aug 6–7, 2026 board meeting. 2026 registrants paid $6,000; the higher fee is not yet in force.
- Nov 1, 2028: under the draft audit rule, brokers that met the broker definition any time between Aug 1, 2026 and Dec 31, 2027 owe their first independent DROP audit report, covering the audit period Aug 1, 2026 – Aug 1, 2028, recurring every three years after.
Methodology
Data sources
- CPPA data-broker registry, full CSV export: cppa.ca.gov/data_broker_registry/registry.csv (retrieved Oct 9, 2026; 603 rows, unchanged from the Aug 24, 2026 count).
- Stipulated final orders and CPPA enforcement announcements: cppa.ca.gov/announcements/2025/20250227.html (Background Alert), cppa.ca.gov/announcements/2025/20251203.html (ROR Partners), privacy.ca.gov Order of Decision, ENF26-05-D-LO (LocateSmarter), privacy.ca.gov announcement, Aug 11, 2026 (LocateSmarter), privacy.ca.gov announcement, Sep 1, 2026 (SalesIntel Research, Case No. ENF25-221-D-SA, order signed Aug 27, 2026).
- CalPrivacy newsroom: privacy.ca.gov, Aug 25, 2026 (the 500,000+ DROP figure); Governor's press office: gov.ca.gov, Aug 13, 2026 (the Cybba action).
- CPPA board meeting materials, Aug 6–7, 2026 (Agenda Item 9, registration fee; Agenda Item 10, draft audit regulations): cppa.ca.gov.
Computation
The registry statistics are computed from the "Requests to delete" columns of every row in the 603-broker CSV: total requests received, complied in whole, complied in part, and denied, all for calendar year 2024 as self-reported by each broker. A broker's denial rate is denied ÷ total requests received; brokers reporting zero total requests are excluded from the denial-rate distribution and counted separately. The enforcement running total sums each stipulated order's monetary penalty in chronological sequence; the one action resolved by a company shutting down instead of paying (Background Alert) is listed for completeness but excluded from the dollar total, matching the CPPA's own published accounting.
Update cadence
The enforcement tracker updates within days of each CPPA enforcement announcement. Registry
statistics refresh monthly, or immediately after the CPPA republishes its registry CSV.
This page's dateModified reflects the most recent update of either.
How to cite this page
Source: OptOutReady DROP Compliance Index, optoutready.com/drop-compliance-index, retrieved [date].
Questions we get about these numbers
How many data brokers are registered in California?
603, counted directly from the CPPA's live registry CSV, most recently re-verified October 9, 2026 (unchanged since August 24, 2026). The count moves as brokers register, deregister, or are removed for noncompliance, so check cppa.ca.gov/data_broker_registry/registry.csv for the current file.
Has any data broker been fined for missing a 45-day DROP deletion cycle?
No. Every CPPA enforcement action to date, including the August-September 2026 actions against LocateSmarter, Cybba, and SalesIntel Research, is a registration and/or general CCPA case. The 45-day deletion-cycle obligation under Civil Code §1798.99.86(c) took effect August 1, 2026, and as of this writing no broker has been fined specifically for violating it.
What is the fine exposure for missing a DROP deletion request?
Civil Code §1798.99.82(d)(1) authorizes penalties of $200 per deletion request per day for DROP noncompliance, with no cure period, plus the agency's investigation costs. That is the statutory exposure math, not a precedent: it hasn't yet been the basis of an actual fine, since the deletion-cycle requirement is only weeks old as of August 2026.
How much has the CPPA collected in data-broker enforcement fines so far?
$697,290 across 14 enforcement actions since November 2024: 13 monetary penalties plus one case, Background Alert, resolved by the company shutting down instead of paying its $50,000 fine. All 14 are registration and/or CCPA cases; see the enforcement tracker on this page for the full list with sources.
OptOutReady runs the 45-day DROP deletion cycle, registration filings, and audit-ready recordkeeping for small registered data brokers. If your firm shows up in the numbers above and you'd rather have someone else run the cycle, we can talk it through.
Book a 20-minute call