1. (a) Upon accessing the DROP in accordance with section 7612, a data broker must do the following to process deletion requests in compliance with Civil Code section 1798.99.86:

   1. (1) Compare the consumer identifier information contained in each consumer deletion list with the applicable consumer personal information maintained in the data broker's own records.

      1. (A) Prior to comparing consumer identifier information between a consumer deletion list and a data broker's records, a data broker must standardize the applicable personal information from the data broker's records as follows:

         1. (i) Use all lowercase letters, including changing names to lowercase;

         2. (ii) Remove extraneous or special characters; except for:

            1. 1. non-English language characters, which shall instead be converted to its closest matching English language character. For example, Björn O'Connor-López shall be formatted as bjornoconnorlopez; and
            2. 2. email addresses.
         3. (iii) Format date of birth, when applicable, as a string of 8 numbers in order of year, month, and date. For example, January 12, 1990 shall be formatted as 19900112.
         4. (iv) Format zip code, when applicable, as a string of the first 5 characters of the zip code. For example, the zip code is 95811-6213 shall be formatted as 95811.
         5. (v) Format phone number, when applicable, as a string of the last 10 numbers without any dashes or country code. For example, the phone number +1(987) 765-4321 shall be formatted as 9877654321.
         6. (vi) Implement any other standardization that the data broker knows will increase the likelihood of a match between its records and the applicable consumer deletion list.
      2. (B) After completing the standardization described in subparagraph (A), a data broker must use the same hashing algorithm provided in the consumer deletion list to hash the consumer personal information within the data broker's records that is the same category of identifier as in the consumer deletion list.
      3. (C) A data broker is only required to standardize its consumer personal information for purposes of complying with this section. A data broker is not required to maintain consumer personal information in a standardized format for any other purpose.

   2. (2) For every match between the consumer deletion list and the data broker's own records, the data broker must delete all personal information associated with a matched identifier as described in subsection (b).

      1. (A) If the consumer deletion list that the data broker is comparing to its own records includes multiple identifiers, the data broker must hash each applicable identifier from its records, then combine the multiple hashed identifiers for each consumer into a single identifier, and then hash the combined identifier before comparing to the consumer deletion list. For example, if a consumer deletion list includes first name, last name, data of birth, and zip code, the data broker shall separately hash each of the following: first name, last name, date of birth, and zip code. After hashing each of the identifiers separately, the data broker shall combine the hashed identifiers for each consumer into a single new identifier, without adding spaces or other characters, before applying the hashing algorithm pursuant to (a)(1)(B) of this section to the combined identifier.
      2. (B) If a data broker associates multiple consumers with a matched identifier from the consumer deletion list, the data broker must opt each associated consumer out of the sale or sharing of its personal information in accordance with Civil Code section 1798.99.86(c)(1)(B) and (D), and comply with subparagraph (b)(1)(B) of this section.

2. (b) When deleting the personal information associated with a matched identifier, the data broker must:

   1. (1) Delete all consumer personal information, including inferences based in whole or in part on personal information collected from third parties or from a consumer in a non-“first party” capacity, that is associated with a matched identifier in the data broker's records.

      1. (A) Notwithstanding paragraph (1), a data broker is not required to delete personal information that is exempt under Civil Code section 1798.99.86, or that the data broker collected directly from the consumer as a “first party,” as that term is defined in California Code of Regulations, title 11, section 7001.
      2. (B) Notwithstanding paragraph (1), a data broker must continue to maintain the minimum personal information necessary to facilitate compliance with Civil Code section 1798.99.86(c) and (d) for each consumer that submits a deletion request, unless the consumer later amends or cancels their deletion request. The personal information maintained by the data broker for this purpose does not need to be personal information provided by the Agency through the DROP, except when necessary to comply with subsection (c) of this section. A data broker must not use personal information maintained pursuant to this subparagraph for any other purpose unless a statutory exemption applies.

      3. (C) For purposes of this section, “delete” means permanently and completely erasing the personal information from existing systems, including archived or backup systems, deidentifying the personal information, or aggregating consumer information, except as provided in subparagraph (b)(1)(B) of this section.

         1. (i) Notwithstanding subparagraph (C), a data broker may delay deletion of personal information contained in archived or backup systems until the archived or backup system is restored to an active system, or accessed for a sale, disclosure, or other commercial purposes.
3. (c) For deletion requests that do not match to any consumer personal information within the data broker's records at the time of comparison, the data broker must save and maintain the consumer deletion list for the sole purpose of complying with Civil Code section 1798.99.86(d) by comparing any newly collected records with deletion lists before new personal information is sold or shared, unless the consumer later cancels their deletion request.
4. (d) A data broker must direct all service providers and contractors to delete all personal information in its possession related to a consumer associated with a matched identifier in accordance with Civil Code section 1798.99.86(c) and (d).
5. (e) A data broker may share with service providers and contractors the minimum personal information necessary to facilitate compliance with subsection (c) of this section.

Note: Authority cited: Section 1798.99.87, Civil Code. Reference: Section 1798.99.86, Civil Code.

History

1. New section filed 11-6-2025; operative 1-1-2026 (Register 2025, No. 45).