CPPA Votes to Advance Data Broker Regulations

The California Privacy Protection Agency (CPPA) voted to advance proposed regulations under California’s new Delete Request and Opt-Out Platform (DROP).  DROP is expected to upend the data broker industry in California and provide consumers with more control over their data. Wilson Sonsini writes about the DROP regulations:

“The DROP will allow California residents to submit a single request to delete all personal information held by all data brokers operating in the state via an accessible mechanism. Data brokers would be required to access the DROP for updates every 45 days and delete the personal information of any state resident that matched the data broker’s records unless a deletion exception set forth in the California Consumer Privacy Act (CCPA) applies.”

The DROP regulations have now been given the green light to advance to formal rulemaking. Once CPPA staff make the necessary changes and publish the proposed rules a 45-day public comment period will begin. The DROP is part of California’s broader “Delete Act” which strengthens California’s ability to regulate data brokers both in and out of state. Companies that collect consumer data of any kind should review their practices in light of the Delete Act’s provisions. Even companies that may not consider themselves “data brokers” could fall within the boundaries established by the Delete Act and face compliance obligations.