California's DROP Deadline Just Passed — Here's What It Means If You Handle Third-Party Data
California's Delete Act reached a real operational deadline on August 1, 2026. Registered data brokers are now required to check the state's new deletion platform, DROP, at least once every 45 days and act on every consumer request they find there. This isn't a proposal anymore. It's active, with real financial penalties attached.
What DROP Actually Is
The Delete Request and Opt-Out Platform lets a California resident submit one deletion request that reaches every registered data broker at once, rather than contacting each company individually. Consumers have been able to submit requests since January 1, 2026. As of August 1, brokers are required to retrieve and act on them.
Are You Actually a Data Broker
California defines a data broker as any business that knowingly collects and sells the personal information of a consumer it does not have a direct relationship with. The definition is deliberately broad, and there's no revenue threshold or partial exemption. A business that primarily sells its own products but also sells or shares customer data with a third party it has no direct relationship with can still qualify, even if that's a small part of its operations.
For most Shopify sellers, this doesn't apply. If you collect data from your own customers and don't sell it onward to unrelated third parties, you're not a data broker under this definition, regardless of your size.
The Penalties Are Real
Failing to register carries a $200 per consumer, per day administrative fine, doubled from $100 by a 2025 amendment. Once the August 1 deadline passed, failing to process a deletion request within the required window carries the same $200 per day penalty. Registration itself costs $6,000 annually for 2026.
The Detail Worth Knowing Even If You're Not a Broker
SB 361 also expanded what registered brokers must disclose, now including whether they collect specific sensitive categories: sexual orientation, union membership, and citizenship status among them. If your business works with any third-party data broker as a customer or partner, it's worth knowing this level of scrutiny now applies to that relationship.
Check Your Actual Status
All information in this article is sourced from the California Privacy Protection Agency's official DROP guidance at privacy.ca.gov and cppa.ca.gov, and independent legal analysis from Alston & Bird and Troutman Pepper. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.
Regulens tracks California's evolving privacy framework as part of its ongoing state-by-state coverage. Your store's readiness is calculated based on your actual inputs and current policy documents.
Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.
Check your store's California privacy readiness at getregulens.com
Further Reading
Q4 Is Starting — Here's the Multi-State Compliance Check Most Sellers Skip Before It Does
Fourth quarter brings the highest sales volume of the year for most Shopify sellers, which means it also brings the highest chance of crossing a state threshold you haven't checked yet.
Twenty States. One Question Most Sellers Haven't Asked Yet.
As of mid-2026, twenty U.S. states now have comprehensive privacy laws in effect, with four more already signed and coming. Most Shopify sellers checking their compliance still only think about California.