California’s Delete Act is Now Enforceable. What Happens to Your Data Deletion Request?

If you’re one of the hundreds of thousands of Californians who submitted a request for your data to be deleted, you may be wondering why your information hasn’t disappeared yet.

While the state’s DROP platform became available in January 2026, it wasn’t until August 1 that data brokers became legally required to act on those requests. Now that the Delete Act is enforceable, anyone who submits a request should know what will actually happen if a company ignores it.

What everyone in California should know about the process is that some wait is still normal, and the law has real financial teeth against brokers that don’t comply.

What is DROP and Why Hasn’t My Data Been Deleted?

DROP stands for the Delete Request and Opt-Out Platform. It’s a state-run tool that lets residents send a single data deletion request to every registered data broker in California. Instead of contacting each company individually, individuals now have the ability to reach numerous brokers all at once. It’s the centerpiece of California’s Delete Act, which opened to consumers on January 1, 2026.

But DROP submissions and having your request acted on were always two different milestones.

Residents who sent in requests in the first half of 2026 were essentially put in a queue; they weren’t first in line for immediate deletion, but that queue is now moving.

Data brokers weren’t required to begin processing requests until August 1. Under the new law, complying with the Delete Act means they must access DROP every 45 days (at minimum) to retrieve and process data deletion requests from consumers.

The gap between January and August wasn’t an oversight. It was built into the law to give time to over 600 registered data brokers in California to connect their systems to the DROP platform.

But what happens after a broker pulls your request? If a consumer’s information matches the broker’s records, they’re required to delete all associated personal data, including what their programs infer from it, unless a legal exemption applies. They must report the status of each request within 45 days of retrieving it.

California’s data privacy tool is the first of its kind in the U.S. In an age where data collection and sales occur far more than the average person realizes, such protections give consumers control of their personal information.

How Long Do Brokers Have to Delete Personal Information?

California data brokers can’t treat this as a one-time chore. The Delete Act requires them to maintain a list of requests, so your information stays deleted going forward. This helps ensure your data doesn’t reappear months later.

The full cycle, which begins with submitting a request and ends with a broker confirming it’s handled, can reasonably take up to 45 days from the date a broker pulls your request.

In practical terms, this means that since brokers only became required to check the platform on August 1, a request that’s still pending less than 45 days from that date isn’t a red flag or sign they failed to follow the new law.

You can check your DROP status online, but keep in mind it can take up to 90 days for an update from a broker. If it’s been longer than that window, that’s when the second question becomes relevant.

What Happens if a California Data Broker Ignores Deletion Requests?

Data brokers that skip their obligations under the Delete Act don’t just risk a warning letter. They can be fined every single day, for every single person whose request they fail to honor.

Thanks to a recent amendment to the law, the daily administrative fine for a data broker that fails to register doubled from $100 to $200 per consumer, per day. That’s what gives the fine real weight.

This means that under the data broker’s legislation, a broker that ignores requests from a large batch of Californians isn’t facing a single penalty; the fine multiples with every day they stay out of compliance and every person affected, which creates significant incentive for brokers to follow the law.

Beyond the obligation to register with DROP prior to the August deadline, the potential fines underscore the larger point. California built financial consequences directly into the data deletion law rather than leaving compliance voluntary.

The California Privacy Protection Agency, which developed and oversees DROP, has been direct about wanting the platform to be more than a symbolic gesture. There’s real money in the sale of personal data, and being able to have your data deleted from hundreds of brokers with one simple action has encouraged consumers to exercise their privacy rights.

Unlike some past consumer privacy tools that relied on companies to self-police, the Delete Act pairs a consumer-facing platform with an enforcement mechanism aimed squarely at brokers that ignore it.

What it Means if You’re Waiting for Your Data to Be Deleted

For the more than 450,000 Californians who submitted a DROP request and haven’t seen confirmation that their data has been deleted, here’s a realistic way to think about where things stand:

• Requests submitted before August 1, 2026: Brokers had no obligation to act on these until August 1. If yours is one of them, it should now be in the active processing window.
• Submissions today: Brokers are required to check DROP at least every 45 days and report on requests they retrieve from within that window. A request that’s been less than 45 days since a broker’s most recent check-in isn’t necessarily a problem.
• An unfulfilled request well past 45 days: Pending requests that aren’t resolved within the window is where a broker’s failure to comply with the Delete Act could cost them $200 fines per consumer, per day.

It’s important to recognize that the Delete Act doesn’t promise instant results. But it does put a deadline and price tag on delays, something most data broker regulations in the U.S. lack.

For everyday Californians who have dealt with the frustration of being ignored by companies holding their personal information, DROP exists exactly for this reason.

Anyone who believes a registered data broker has ignored a valid deletion request or who wants to check a broker’s registration status can find current information on the CPPA website.