--- title: "Process California deletion requests from ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/california-data-broker-drop id: CMP-78 level: Required region: US-CA risk: law updated: 2026-10-27 build: a2a6bdfed830 tokens: 795 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Process California deletion requests from DROP every 45 days For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-78 - Level: Required - Chapter: [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md) - Rule: If you sell personal data of people you have no direct relationship with, register as a data broker in California each January. Fetch and process the deletion requests in DROP at least every 45 days. - Check: The facts file says whether you are a data broker. When you are, a job fails if the last DROP download is more than 45 days old. It also fails on any downloaded request still open after its due date. The obligations register holds this year's registration receipt. - Risk: A law broken - Region: California (US-CA). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: California's Delete Act defines a data broker as a business that knowingly sells personal information to third parties. The test is that it has no direct relationship with those consumers. Brokers register and pay each year from 1 to 31 January. The Delete Request and Opt-out Platform (DROP) lets a person send one deletion request to every broker. Since 1 August 2026, each broker must access DROP at least once every 45 days and process the requests. Match the requests to your records and delete them in every store from [Map every store that holds personal data](https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map.md). Whether you sell at all comes from [List every sale and every share](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/sales-and-sharing-inventory.md). ## Sources - [California Privacy Protection Agency, data brokers and DROP](https://cppa.ca.gov/data_brokers/) ## Related rules - CMP-7 [Map every store that holds personal data](https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map.md) in Compliance and governance - CMP-57 [List every sale and every share](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/sales-and-sharing-inventory.md) in Compliance and governance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Report health data leaks under the FTC rule when HIPAA does not cover you](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/health-breach-notification.md) - [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)