California Delete Act: What the DROP Deadline Means for B2B Data

The California Delete Act is quietly reshaping the B2B databases many small businesses use to find prospects. On October 29, 2026, the deadline passed for registered data brokers to complete at least one full cycle of processing consumer deletion requests from DROP, the state’s Delete Request and Opt-out Platform, as Bubeck Law reported on October 28.

For US sales teams, that means California records in purchased lists will keep shrinking, and contacts you bought last year may no longer be ones a broker is allowed to hold. Below, we explain what changed, whether it touches B2B contact data, and the practical steps we recommend. This is general information, not legal advice.

What is the California Delete Act and the DROP platform?

The California Delete Act is a state law that requires registered data brokers to delete the personal information of California residents who ask, through a single state-run request. DROP is the free website, run by the California Privacy Protection Agency (now branded CalPrivacy), where residents submit that one request.

A data broker is, in general terms, a business that knowingly collects and sells personal information about California residents it has no direct relationship with, subject to legal exceptions. In its Delete Week announcement of October 12, 2026, CalPrivacy said:

• More than 560,000 Californians have registered for DROP since it launched on January 1, 2026.
• One request reaches more than 660 data brokers.
• Profiles reported as deleted by brokers are approaching 100 million.
• A typical DROP user has had information reported deleted by more than 150 brokers.

Note that 100 million profiles is not 100 million people; several brokers can hold separate profiles on the same person.

What happened on the October 29, 2026 DROP deadline?

October 29 was the date by which brokers had to finish their first complete round of downloading DROP requests, matching them to their records, deleting what applies, and reporting results back. From here on the work is recurring, not one-off.

According to Freshfields’ August 20, 2026 analysis, CalPrivacy’s proposed audit rules would require independent audits every three years and would add a “suppression list” duty, so brokers screen new data against people who already used DROP. The annual registration fee for 2027 is $9,500. As of November 2026, the audit rules were still proposals, so watch for final text.

Does the California Delete Act apply to B2B contact data?

Very likely, yes, for California residents. None of the sources we reviewed carve out business contact data from DROP, and California’s privacy law no longer has a broad B2B exemption.

The California Consumer Privacy Act once excluded personal information collected about business contacts in a business-to-business context. That exemption was set to expire on January 1, 2023 after the legislature did not extend it. In practice, a California sales director’s name, title and work email can be personal information, and a broker that sells it may have to honor that person’s DROP request.

What remains unclear is how each vendor matches DROP identifiers to work records. Some match on personal emails and phone numbers, which may leave business fields untouched. That is exactly why you should ask.

Is your B2B data provider a data broker?

If a vendor sells you contact records for people it has no direct relationship with, it may be a data broker under California law. Many sales intelligence platforms and list sellers fit that description; firms that only process your own data on your instructions usually play a different role.

Questions to ask any data vendor

• Are you on the California data broker registry? Registration is public, and the IAPP reported that failing to register carries a penalty of $200 per day.
• How often do you process DROP requests? The answer should be at least every 45 days now and every 30 days from 2027.
• Do deletions flow to records you already sold me? Many contracts say nothing about this.
• Do you keep a suppression list? It should stop deleted people from being re-added from another source.
• Can you show the source and last-verified date for each record?

The stakes for non-compliant brokers are real. Barnes & Thornburg noted that penalties can reach $200 per unprocessed request, per day, and advised companies that license, resell or enrich data to assume they may be in scope until counsel clears them.

How should small businesses adjust their prospect lists now?

Treat California records as a moving target: refresh them more often, document where each one came from, and never quietly reload contacts that have been removed.

1. Re-verify California contacts before each campaign

A record that existed in a vendor file in July may be gone now. Fresh business email finding and verification before you send catches dead addresses and lowers your email bounce rate.

2. Build and keep a suppression list

When anyone asks to be removed, or a vendor tells you a record was deleted, add them to a do-not-contact list that survives every import. Our CRM data cleansing checklist shows where suppression fits, and our CRM data cleansing service can set it up.

3. Keep source notes on every record

Record where each contact came from and when it was last checked. Source-backed fields are the core of good B2B data enrichment, and they make vendor questions easy to answer.

4. Rethink cheap bulk lists

Large, cheap California-heavy lists carry more stale and deleted records than ever. Our guide to the real cost of a cheap B2B database walks through how to judge a list before you pay.

Frequently asked questions

Who has to register as a data broker in California?

In general, businesses that knowingly collect and sell personal information about California residents they have no direct relationship with must register, subject to statutory exceptions. Businesses that acted as data brokers at any point in 2026 must register during the 2027 period. If you resell or license contact data, ask a privacy lawyer whether you are in scope.

What are the penalties under the California Delete Act?

Law firm analyses report penalties of $200 per day for failing to register and $200 per unprocessed deletion request, per day, plus possible investigation costs. CalPrivacy has also set up a data broker enforcement strike force. Penalties fall on brokers, but buyers inherit the risk of using data that should have been deleted.

How often do data brokers have to check DROP?

Registered data brokers must access DROP and process deletion requests at least once every 45 days. Under AB 883, that recurring window shortens to 30 days starting January 1, 2027. Independent audits of how brokers handle DROP requests are scheduled to begin on January 1, 2028.

Can I still prospect business contacts in California?

The Delete Act is aimed at data brokers’ records rather than outreach itself, so prospecting California businesses is still common practice. The safest approach is to use well-sourced, recently verified data, honor every opt-out, and keep a suppression list. This is general information, not legal advice for your situation.

Build prospect lists that keep up with the California Delete Act

We build researched, source-noted B2B contact lists and re-verify records before delivery, so you are not paying for contacts that have already disappeared. Tell us who you want to reach and request a free data sample.

Cover photo: Vitaly Gariev on Unsplash.