Privacy Atlas

Cal. Civ. Code §§ 1798.99.80–1798.99.89

California Delete Act (SB 362)

In force since January 1, 2024

Data brokers: businesses that knowingly collect and sell personal information about consumers with whom they have no direct relationship
Registration with the CPPA is mandatory, with an annual fee and annual disclosures

Access / know — not granted
Correction — not granted
Deletion / erasure — grantedRequire deletion of personal data, subject to the statute's retention exceptions.
Portability — not granted
Opt out of sale / sharing — grantedStop the business selling or sharing your personal data with third parties.
Opt out of targeted advertising — not granted
Opt out of profiling — not granted
Limit sensitive data use — not granted
Human review of automated decisions — not granted
Non-discrimination — not granted
Appeal a refusal — not granted
Private right of action — not granted

Consent model: Opt-out
Universal opt-out signal: Must honour a browser-level opt-out such as Global Privacy Control
Risk assessments: Not required
Data protection officer: Not required
Records of processing: Not required
Processor contract: Not required
Right to cure: None — enforcement may follow immediately
Data broker registration: Required

Headline: $200 per day for failure to register; $200 per deletion request per day
Private right of action: No — enforcement is by the regulator only
Notes: Administrative fines are assessed by the CPPA, alongside expenses and costs of investigation. Registration failures accrue daily.

Entities

January 1, 2026
DROP opens to consumers
The Delete Request and Opt-Out Platform becomes available for consumers to make a single deletion request reaching every registered data broker.

Timeline