United States of America: California Privacy Protection Agency closes consultation on modified regulations implementing Delete Request and Opt-Out Platform under Delete Act (SB 362)

On 18 August 2025, the California Privacy Protection Agency (CPPA) closes the consultation on the modifications to the proposed regulation on the Accessible Deletion Mechanism under the Data Broker Registration framework in the Delete Act. The modified regulation requires data brokers to register annually, maintain a secure account on the central Delete Request and Opt-out Platform (DROP), and process deletion requests from California residents at least every 45 days. It was highlighted that brokers must match hashed consumer data against their records, delete or opt out relevant entries, and report outcomes such as “deleted”, “not found”, or “exempted”. The rules prohibit using DROP data for any non-compliance purposes and ban direct consumer contact for verification.