What California now requires of registered data brokers

California’s Delete Act changed what being a registered data broker means. Registering was step one. Here is the rest, in plain terms.

1. Californians can now ask everyone at once. Before August 2026, a consumer had to find each broker and ask one at a time. Now they file one request with the state, and the state delivers it to every registered broker automatically. More than 300,000 people are already on the list, and it only grows.

2. The list has to be checked every 45 days. Forever. Every 45 days, a broker pulls the state’s delete list and processes it. Eight rounds a year. There is no opt-out from the schedule and no end date. (§7610; the mechanics are in the 45-day DROP cycle, operationally.)

3. The list comes as scrambled codes, and the matching is on you. The state sends hashed identifiers, not names, to protect the people on the list. You standardize your own records the same way, then compare. The state publishes the exact rules, worked examples, and a free checking tool in its sandbox. Matching is learnable. It’s also only the first step. (§7613; see the six DROP hash lists, explained.)

4. Every match gets deleted, and reported back. You delete the matched consumers’ data, then report the outcome of every request to the state: deleted, or denied under a legal exemption. Denials are allowed. Brokers filed nearly 900,000 last year. But each one needs the exemption on file. (§7611; see when a data broker can deny a deletion request for what that record has to hold.)

5. Everyone you gave the data to has to delete it too. The deletion doesn’t stop at your own systems. Service providers and the companies you sold or shared the data with get a deletion directive as well. That means notices, on the record, with proof they went out. No software does this part by itself.

6. The records stay on file for six years. The deletion records, the denial exemptions, the notices. All of it, retained at least six years. (§1798.99.86)

7. Starting January 1, 2028, an independent auditor reads that file. Every three years, a third-party audit checks whether you actually did all of the above, and the state must receive the report within five business days of asking. From 2029, your audit status is published on the public registry, next to your company’s name. The file the auditor reads cannot be created after the fact. (§1798.99.86(e); what to keep is in the 2028 Delete Act audit guide.)

8. The fine is $200 per request, per day, starting the day you miss. No grace period. One mishandled request left unfixed for a month is $6,000, the same as your annual registration fee. The state stood up a dedicated enforcement team in 2025. Eleven enforcement actions so far have totaled $492,000, all for registration failures. The deletion-cycle cases haven’t started yet.

Not sure the definition even covers your business? Take the six-question self-test; it mirrors the statute’s own wording.

That is the whole obligation: pull, match, delete, notify, report, file, repeat every 45 days, keep six years of proof, pass an audit. None of it is impossible. All of it is somebody’s job now.