Overview
- DROP goes live on January 1, 2026, letting consumers send a single recurring deletion request to all registered data brokers.
- Any business that operated as a data broker at any time in 2025 must register with CalPrivacy and establish a DROP account by January 31, 2026.
- Each legal entity must register separately, and a parent or affiliate’s registration does not cover related companies.
- Registrations must list all trade names and websites with functioning links, including a clear privacy-rights page free of dark patterns.
- Failure to register can trigger $200-per-day fines plus fees and enforcement costs, with a new strike force and other regulators signaling heightened scrutiny into 2026.