Law / United States / 
California
Delete Act: processing deletion requests from the accessible deletion mechanism (DROP)
Also known as Delete Act.
Cal. Civ. Code sections 1798.99.86 and 1798.99.82(d)
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
As of .
What it requires
- If you are a data broker, access the California Privacy Protection Agency's accessible deletion mechanism (the Delete Request and Opt-Out Platform) at least once every 45 days, and within 45 days of receiving a deletion request through it, delete all personal information related to the consumer who made it.
- You need not delete personal information it is reasonably necessary to keep for a purpose listed in section 1798.105(d), or whose deletion section 1798.145 or 1798.146 does not require. Use what you keep only for that purpose, never for marketing or any other purpose.
- Direct all your service providers and contractors to delete all personal information in their possession related to each consumer whose deletion request you process.
- If you deny a deletion request because it cannot be verified, process it within 45 days as an opt-out of the sale or sharing of the consumer's personal information, and direct your service providers and contractors to do the same.
- After deleting a consumer's data under a request, delete all of that consumer's personal information again at least once every 45 days, unless the consumer requests otherwise or section 1798.99.86(c)(2) excuses the deletion.
- After deleting a consumer's data under a request, do not sell or share new personal information about that consumer unless the consumer requests otherwise or section 1798.145 or 1798.146 permits it.
- Pay any access fee the Agency charges when you access the mechanism; it may not exceed the reasonable cost of providing that access.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civ. Code section 1798.99.82(d): each deletion request a data broker fails to delete as section 1798.99.86 requires is a violation, and the administrative fine of $200 for it accrues for each day it remains undeleted, so the amount multiplies by both the number of requests and the number of days. The Agency also recovers its reasonable expenses of investigation and administration. The fine attaches to a failure to delete; other failures under section 1798.99.86 carry the expenses alone.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 200
Who enforces it
Enforcement body
California Privacy Protection Agency, in an administrative action (Civil Code section 1798.99.82(d)). The title creates no private right of action.
What this law does
The California Privacy Protection Agency runs an accessible deletion mechanism through which a consumer, in a single verifiable request, can ask every data broker that holds their personal information to delete it. The Agency calls the mechanism the Delete Request and Opt-Out Platform (DROP).
Beginning , a data broker must access the mechanism at least once every 45 days and, within 45 days of receiving a deletion request, delete all personal information related to the consumer and direct its service providers and contractors to delete it too.
A data broker need not delete information it is reasonably necessary to keep for a purpose listed in section 1798.105(d), or whose deletion section 1798.145 or 1798.146 does not require, and may use what it keeps only for that purpose. A request the data broker cannot verify is processed as an opt-out of the sale or sharing of the consumer's personal information.
After deleting a consumer's data, the data broker must delete that consumer's personal information again at least once every 45 days and may not sell or share new personal information about them, unless the consumer requests otherwise or an exemption applies. A data broker that fails to delete as required is liable in an administrative action by the Agency for a fine of $200 for each deletion request for each day, plus the Agency's expenses.
When LexLint raises it
When your app profile says your app crawls the web or tracks devices.