Hello CIPAWorld. CalPrivacy just issued a reminder that all data brokers active in DROP must have completed at least one full cycle of deletion request processing no later than October 29, 2026.
According to CalPrivacy, if you have not yet completed one full cycle, you must do so within forty-five (45) days of your initial download date.
The agency provided recommendations for efficient processing. To save you the time of looking them up we have provided them below:
- Uploads: Upload one file per consumer deletion list when you upload your response. While the system technically supports uploading multiple files per list, high volumes of files can cause processing delays.
- Amends: Combine records of the same list type across batches into one file for amending.
- Help and Support: Please include your four‑digit data broker ID when you contact us so we can quickly identify your account.
- Review processing status: To check on the status of your processing activity, review the notification emails sent via DROP to the primary and secondary emails listed on your account. You may also review details related to your processing status on your dashboard.
Changes to Deletion Processing Request Timeline (AB 883)
With the passage of AB 883, data brokers are required to process deletion requests within thirty (30) days, effective January 1, 2027. CalPrivacy stated that it will share additional information and workflow details soon.
2027 Annual Registration Period
The Annual Registration Period will begin on January 1, 2027. Any business that operated as a data broker in calendar year 2026 must submit its registration information and payment to CalPrivacy during the registration period. The annual registration fee for 2027 will be $9,500.
If you need any further assistance or a review of your current policy and processes, the compliance team at Troutman Amin is available to counsel you on meeting your regulatory and legal obligations.