California regulates the trade in personal data more directly than any other US state. In 2026 three parts of that regime came together.
The Delete Act and DROP
The Delete Act requires data brokers to register with the state privacy agency, now known as CalPrivacy. Since 1 January 2026 residents have been able to use the state’s Delete Request and Opt-Out Platform (DROP) to send one deletion request to every registered broker. Since 1 August 2026 brokers have had to collect and act on those requests on a 45-day cycle.
By August 2026 more than 600 brokers had registered and about 450,000 Californians had submitted requests, according to one law firm’s summary of agency figures. The annual registration fee is due to rise in 2027, and independent audits of brokers begin in 2028.
The browser opt-out
The Opt Me Out Act (AB 566) requires web browsers to include a built-in opt-out preference signal by 1 January 2027. Businesses covered by the CCPA already have to honour that signal when they receive it.
What enforcement shows
Three 2026 actions point the same way. The Attorney General settled with Disney for $2.75 million in February. CalPrivacy fined a school sports ticketing platform $1.1 million and reached a smaller settlement with Ford. The recurring failures were opt-outs that did not cover every service, signals that were ignored, forced acceptance of tracking, and unnecessary steps placed in the consumer’s way.
Regulators are testing whether the opt-out works, not reading the privacy policy.
What this means
A business that sells data about people it has no direct relationship with should check whether it is a data broker. Any business with Californian users should test its opt-out signal handling across every site and app. Private services that act for consumers now operate alongside a free state platform that does part of the same job.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.