Delete Request and Opt-out Platform (DROP) Audits

Preliminary Rulemaking Activities

CalPrivacy is exploring whether to adopt regulations to clarify or further specify the audit requirement for processing deletion requests. The Agency is gathering information and seeking input from stakeholders about this topic.

CalPrivacy solicited preliminary written comments related to the requirements for data broker audits from the public via its Invitation for Preliminary Comments – Delete Request and Opt-out Platform (DROP) Audits.

CalPrivacy will be accepting preliminary comments from April 7, 2026 until 5:00 p.m. PT on May 7, 2026.

Where to Submit Preliminary Comments

Electronic Submission:

Comments may be submitted electronically to regulations@cppa.ca.gov. Please include “Preliminary Comment – DROP Audits April 2026” in the subject line.

Mail Submission:

California Privacy Protection Agency
Attn: Legal Division – Regulations
400 R St., Suite 350
Sacramento, CA 95811

Preliminary Comments

The preliminary comments sought in this invitation are to assist CalPrivacy with its preliminary rulemaking activities and do not reflect any decisions made by CalPrivacy regarding future rulemaking. If CalPrivacy decides to propose regulations, a formal public comment period will be held at a later time during the formal Administrative Procedure Act rulemaking process. All preliminary comments received by CalPrivacy are public records subject to disclosure and may be included in future rulemaking packages.

Questions

Questions regarding this Request for Preliminary Comments may be directed to regulations@cppa.ca.gov.

Further Information

Information regarding the rulemaking process will be posted to https://cppa.ca.gov/regulations/. If you would like to receive notifications regarding rulemaking activities, please subscribe to the “Rulemaking Proceedings” email list at https://cppa.ca.gov/webapplications/apps/subscribe/. Please note that comments are public records and will be published on the Agency's website.