What the Delete Act Closes That CCPA Left Open
California’s CCPA (and its successor, CPRA) gave California residents the right to request deletion of their personal data from companies they had a direct relationship with. The gap the Delete Act addresses is the data broker ecosystem — companies that collect and trade personal data entirely outside any direct consumer relationship. A person who buys a mattress online may have their name, address, purchase history, income estimate, and lifestyle segment sold to a data broker, licensed to a second broker, enriched with location history from a third, and packaged into a marketing audience by a fourth — without the consumer ever knowing which of these downstream entities holds their data or how to request deletion from any of them.
The CCPA’s individual-request mechanism failed against data brokers because it required consumers to know which data brokers hold their data, identify each one individually, submit separate deletion requests to hundreds of companies, verify each request through a separate identity verification process, and repeat this annually as data re-aggregates. The Delete Act replaces this individual hunt with a centralized opt-out: California residents submit a single deletion request through the CPPA’s deletion mechanism, and all registered data brokers must honor it within 45 days.
The August 1, 2026 deadline is the date by which the CPPA’s centralized deletion mechanism must be operational and data brokers must be honoring requests flowing through it. The registration obligation (creating the registry that makes this mechanism work) has been active since January 1, 2024 — brokers who have not yet registered are already in violation.
Advertisement
Who Is a Data Broker Under California SB 362
The Delete Act defines a data broker as any business that knowingly collects and sells or licenses to third parties the personal information of a consumer with whom the business does not have a direct relationship. The critical phrase is “does not have a direct relationship” — the data broker definition captures the downstream ecosystem, not first-party data holders.
1. Register with the CPPA by August 1, 2026 — or Face $200/Day Per Broker Fines
Every data broker operating on California resident data must register annually with the CPPA and pay the registration fee ($500 for businesses with fewer than 5 employees; higher tiers for larger businesses). Registration requires disclosing: business identity and contact information, the categories of personal information sold or licensed, a description of the data collection practices, and whether the broker processes data of minors.
The $200 per day per data broker fine structure is distinct from CCPA’s revenue-based fines. A data broker that fails to register for 90 days faces $18,000 in fines before any enforcement action is even filed — and the CPPA has signaled it will pursue aggressive enforcement after the August 1 mechanism deadline. Non-registration is a per se violation: the CPPA does not need to prove harm to consumers, only that the broker operated without registration.
Three categories of business that may not have self-identified as data brokers but may fall within scope:
AI training data vendors: If your company aggregates personal data (social media profiles, consumer behavior datasets, demographic databases) and licenses this data to third parties for AI model training, you are likely a data broker under SB 362. The CPPA has taken a broad view of “selling or licensing” that includes licensing for model training purposes.
Programmatic advertising infrastructure: Data management platforms (DMPs) and demand-side platforms (DSPs) that process California resident data and make it available for audience targeting, even when the final transaction is with an advertiser rather than a consumer, are operating within the data broker ecosystem. The CPPA’s guidance from its January 2025 enforcement advisory covers “audience segment providers” explicitly.
People-search and background check services: Any platform that aggregates name, address, phone, employment history, and relationship data from public records and licenses access to individuals or businesses is a data broker without question. These services have the largest exposure under the Delete Act — their entire business model is selling personal information about individuals with whom they have no direct relationship.
2. Honor Deletion Requests Through the CPPA Mechanism Within 45 Days
From August 1, 2026, when a California resident submits a deletion request through the CPPA’s centralized mechanism, every registered data broker must delete that consumer’s personal information within 45 days. The deletion obligation covers personal information held directly by the broker and personal information transferred to service providers in the preceding 12 months.
The technical implementation requirements are non-trivial. Brokers must implement an API connection to the CPPA’s deletion request system, build identity resolution logic to match incoming deletion requests to the correct consumer records in their databases, maintain deletion audit trails to demonstrate compliance, and re-delete data for the same consumer on an annual basis if re-aggregation occurs.
For AI training data vendors, the deletion obligation intersects with a difficult technical question: can you delete a consumer’s data from a trained model? The CPPA’s current guidance takes the position that deletion applies to the training dataset and to any derived profiles, not to the model weights themselves — but this interpretation is not final, and litigation on this point is anticipated.
3. Implement Re-Identification Safeguards and Annual Re-Deletion
The Delete Act includes an anti-circumvention provision targeting the common data broker practice of re-aggregating deleted data from other sources. If a consumer’s data is deleted in response to a deletion request, the data broker cannot re-acquire and process that same consumer’s data from another data broker or data aggregator for at least 90 days. Annual re-deletion is required for consumers who made a deletion request: the CPPA mechanism allows consumers to make standing deletion requests that persist year-over-year, and brokers must honor these persistent requests at each annual registration renewal.
The August 1 Enforcement Reality: What CPPA Is Signaling
The CPPA announced in March 2026 that it would publish the first public data broker registry on August 1, 2026 — the same date the deletion mechanism becomes operational. Companies that are not registered by August 1 will appear on a public “non-compliant broker” list that the CPPA intends to update monthly. This public disclosure mechanism creates reputational risk beyond the $200/day fine structure: enterprise clients procuring data from brokers have begun including Delete Act registration as a contractual requirement in data vendor due diligence.
Two CPPA enforcement advisories from early 2026 are significant for compliance planning:
January 2026 Advisory: The CPPA confirmed that data brokers who registered under the old data broker law (California Civil Code § 1798.99.80, the pre-Delete Act registry) must re-register under SB 362 — the registrations are not automatically transferred. Brokers who assumed their 2023 or 2024 registration carried over are wrong and should verify their SB 362 registration status immediately.
March 2026 Advisory: The CPPA confirmed that the 45-day deletion window begins from the date the CPPA mechanism transmits the request to the registered broker, not from the date the consumer submits the request. This matters operationally: brokers must have real-time or near-real-time API monitoring of the CPPA deletion feed, not a weekly or monthly batch process.
Frequently Asked Questions
Does the Delete Act apply to a company that provides analytics software but does not sell data — it only processes data on behalf of its clients?
No. If your company acts exclusively as a service provider processing data on behalf of clients (as a data processor, in GDPR terminology) and does not independently sell or license that data to third parties, you are not a data broker under SB 362. The data broker definition requires that the business sell or license personal information to third parties, not merely process it under contract. However, if your analytics platform also resells aggregate audience data, derived insights, or anonymized behavioral datasets to other parties as a separate product line, that secondary activity may qualify as data brokerage.
What does “deleting” data from an AI training dataset actually mean under California law?
The CPPA’s current guidance (January 2026) requires deletion from: (a) the original training dataset files, (b) any fine-tuning datasets derived from the training data that retain individual-level records, and (c) any consumer profiles derived from and identifiable to the individual. It does NOT currently require deleting the trained model weights themselves, on the theory that model weights are a mathematical transformation rather than a copy of the original data. This interpretation is subject to legal challenge and may evolve. Companies in the AI training data business should monitor CPPA guidance on this point actively.
If a data broker registers under SB 362 but a consumer’s deletion request includes data that was licensed to three downstream buyers before the request — who is responsible for deleting from the downstream buyers?
The originating data broker bears responsibility for notifying all known downstream buyers to delete the consumer’s data. SB 362 requires brokers to maintain records of all third parties to which consumer data was transferred in the preceding 12 months. Upon receiving a deletion request, the broker must notify each downstream buyer within 5 business days. The downstream buyer then has its own 45-day deletion window. This chain-of-deletion requirement is one of the most operationally complex aspects of the law for brokers who operate in syndicated data markets.
—
Sources & Further Reading
- California Delete Act (SB 362) — California Legislative Information
- CPPA Data Broker Registry Enforcement Advisory (March 2026) — California Privacy Protection Agency
- Delete Act Implementation Timeline and Registration Portal — CPPA
- SB 362 Compliance Guidance for AI Training Data Vendors — Future of Privacy Forum
- California Privacy Rights Act (CPRA) and Delete Act Interaction — IAPP
🔗 Related Intelligence
US State AI Laws in 2026: Colorado, California, Texas, and the Federal Collision
US Take It Down Act: What Platforms Must Do by May 2026 — and What It Signals for Global Regulation
The US SECURE Data Act: How Federal Privacy Preemption Changes the Rules for Every Business Collecting American Data
Platform Liability 2026: Section 230, the DSA, and the Global Battle Over Internet Rules
