California Delete Act: CalMatters and The Markup Launch DROP Audit

of treating privacy fines as a minor cost of doing business is over.

Section 6:

Technical and Operational Hurdles of DROP Compliance

The backend operations required for a data broker to achieve and maintain compliance under the California Delete Act are highly complex. Data brokers cannot simply delete entire databases; they must parse out matching records while preserving legitimate business records exempt under law (such as those required for active transactions or legal compliance). To protect consumer privacy, DROP transmits deletion lists using secure APIs. As a result, brokers must implement advanced systems to safely ingest, standardize, and cross-reference these lists across highly fragmented database environments.

Furthermore, the Act’s downstream requirements mandate that data brokers cascade these deletion requests to all third-party vendors, subprocessors, and contractors who may have purchased or leased the consumer’s data in the past. This effectively forces data brokers to police their entire supply chain. Additionally, brokers must build and maintain robust “suppression lists” to guarantee that newly scraped internet data does not accidentally recreate profiles for consumers who have already opted out. Any breakdown in this intricate technical pipeline represents a direct path to regulatory penalties.

Section 7:

A National Blueprint for Digital Sovereignty

<