A deletion request is now a standing instruction

A deletion request used to be a message. You sent it, a company acted on it or did not, and if your name reappeared the following month you sent another. Since the first of August, California has treated that request as something else: it is a standing instruction the state holds open for you, and every registered data broker has to access the accessible deletion mechanism and read it.

The instruction has two halves, and they are not equally easy to escape. A broker may stop deleting your record on grounds that do not let it start selling you again. That asymmetry sits in the statute’s grammar.

A data broker is a business that knowingly collects and sells personal information about a consumer with whom it does not have a direct relationship. Your bank is not a data broker to you. The company that bought your address is.

The state’s platform is called DROP. One verified request goes to over 600 data brokers, and the agency promises to “never charge you to use DROP”. Its account of what comes back lists four outcomes that are not deletions. One is “Partial deletions”: a broker that also collects from you directly must delete what it got from other sources, but not what you handed over yourself.

From the first of August, a registered broker has to open that platform at least once every 45 days and take down the requests waiting in it. It then has 45 days to process one. The regulations supply the mechanics: match the request against its records, then delete and report the outcome at each subsequent access.

That is where the agency’s consumer-facing number comes from. Its DROP page tells Californians that data brokers must delete their data within 90 days. The statute never states that figure. It states 45, twice, in series.

Subdivision (d) is what makes the request standing. Once a broker has deleted someone, it must go on deleting that person’s personal information every 45 days. Separately, it shall not sell or share new personal information about them. Deleting keeps the record clear. The bar on selling stops it being rebuilt.

Both have exits, and the exits are not the same. The duty to keep deleting is lifted where the deletion “is not required pursuant to paragraph (2) of subdivision (c)”. That paragraph reaches the business purposes in section 1798.105(d) and the exemptions in sections 1798.145 and 1798.146. The bar on selling is lifted only where selling “is permitted under Section 1798.145 or 1798.146.”

The business-purpose route is missing from that second list. It runs to eight grounds, each turning on what is reasonably necessary to the business: security, debugging, complying with a legal obligation, internal uses aligned with what the consumer expected. Each can justify holding your record after you have asked for it to go. None reaches the sentence that governs selling.

Duty, §1798.99.86	What it requires after a deletion	The ways out the section gives it
(d)(1)	Keep deleting the person’s personal information at least once every 45 days	The consumer asks otherwise · the eight business purposes of §1798.105(d) · §1798.145 · §1798.146
(d)(2)	Do not sell or share new personal information about that person	The consumer asks otherwise · §1798.145 · §1798.146

The fines are priced by the day. Failing to register costs an administrative fine of $200 for each day. Failing to delete costs $200 for each deletion request for each day, a figure the agency also puts to brokers per day on their own registration page. The second is metered per person as well as per day.

How much of the trade this reaches has been measured in part, by someone else. A Stanford-affiliated team published an assessment of data broker compliance with California privacy law in May, and its Table 2 counts how many registrants declare themselves subject to each of five regimes the deletion duty routes around.

Those declarations stay uncommon on the file the agency published on July 29: of 603 registrants, 53 declare at least one of the five and 550 declare none. The file a year earlier held 543. These are declarations, not findings, and sections 1798.145 and 1798.146 run wider than the five regimes the form asks about, so declaring none of them is not the same as having no way out.

The register keeps filling. In June the agency counted 581 registered brokers and more than 300,000 sign-ups. Since August 1 its newsroom has carried nothing about how the first cycle has gone.

The firmer limits sit elsewhere. The agency policing the whole register was authorized 53 positions in the fiscal year that ended in June, and 61 in the budget presented for this one. Its enforcement division has written that some brokers “hide the ball” on registration. And the definition does more work than either: a business you deal with directly is not a data broker to you, whatever else it does with your file. The May paper’s own headline finding was a 9.2% compliance rate on the obligation it tested.

Two decisions this month show the platform used as a remedy. On August 11 the agency announced a decision against a data broker, which it describes as its first brought against one under both the CCPA and the Delete Act, ordering $116,490 in fines and fees. On August 13 it announced a second, fining $52,400 under the Delete Act alone. The board signed both on August 10. Both orders then impose the same requirement, in the same words. Each respondent “shall access the Agency’s Delete Request and Opt-out Platform” and “process consumer deletion requests in accordance with Civil Code § 1798.99.86”, for as long as it operates as a data broker.

That requirement is the shape of the new arrangement: a company caught breaking the registration rule is not fined and released, but enrolled in the cycle every other registrant joined on the first of August. For the person who filed it, the work is finished at the point of filing. They may alter a previous request after 45 days. What follows belongs to the companies, and it comes round again without them.