Consumer Reports and EPIC submitted comments to the California Privacy Protection Agency (CPPA) in response to its Notice of Proposed Rulemaking on Accessible Delete Mechanism – Delete Request and Opt–out Platform (“DROP”) System Requirements.
The DROP will serve as the publicly accessible universal deletion mechanism that consumers will be able to access, beginning in August 2026, to delete their personal information held by the state’s registered data brokers.
The proposed rules would create technical standards guiding data brokers’ access to the DROP and deletion of consumers’ personal information. CR provided several suggestions to the Agency to ensure that the DROP is as consumer protective as possible. These include:
- Ensuring a broad definition of the term “direct relationship,” which governs when a business that is selling the personal information of consumers to third-parties is considered a data broker for purposes of the Delete Act;
- Limiting data leakage from sharing hashed identifiers; and
- Considering how authorized agents can assist in the deletion of consumer records.
To read the full comments, please see the attached PDF.