California implements new data broker deletion requirements

Under the California Delete Act, registered data brokers are now required to comply with new deletion obligations via the state’s Delete Request and Opt-Out Platform (DROP). Starting today, more than 500 registered brokers must access the platform at least once every 45 days to retrieve and delete personal information and any derived inferences for users who have signed up for the service.

This mandate requires brokers to ensure their service providers and contractors also complete the deletions. If a broker re-acquires information previously deleted, they must process it again in the next 45-day cycle. Additionally, the Delete Act prohibits brokers from selling or sharing new personal information regarding any consumer who has submitted a deletion request.

These regulations follow investigations into the data brokerage industry, where companies have been found to build predictive profiles regarding sensitive traits such as health, religion, and political views. In one instance, Epsilon Data Management agreed to a $150 million deferred prosecution agreement after it was found that modeling was used to sell information to fraudulent scheme operators.