1. (a) After a data broker accesses the DROP for the first time, the data broker must, at each subsequent access session, report the status of every deletion request received during the previous access session. If a data broker re-downloaded a complete consumer deletion list, the data broker is only required to report status changes for the most recent new or amended deletion requests.

   1. (1) Notwithstanding paragraph (a), if the data broker matches a consumer identifier found in newly collected personal information after previously not matching the consumer identifier, as described in section 7613(c), the data broker must report the new status of the deletion request with respect to the consumer in the next access session following the match. For example, if a data broker subsequently identifies a match with a consumer identifier in a new set of personal information it collects and deletes that consumer's personal information, it shall report to the Agency at its next access session that the status for the consumer changed from “record not found” to “record deleted.”

2. (b) To report the status of deletion requests, a data broker must upload the following information either manually or by automated means, if supported by the Agency, through its DROP account:

   1. (1) The transaction identifier associated with each consumer deletion request; and

   2. (2) The response code for each transaction identifier that accurately describes the action taken by the data broker with respect to the individual deletion request. A data broker must indicate one of the following response codes for each deletion request:

      1. (A) “Record deleted” when the data broker matched the identifier in the consumer deletion list to the same identifier in the data broker's records and deleted the consumer's personal information associated with a matched identifier as required in section 7613(b).
      2. (B) “Record opted out of sale” when the data broker cannot verify the request because multiple consumers are matched to the identifier, and the data broker opted out from sale or sharing all the personal information associated with all matched consumers.
      3. (C) “Record exempted” when the data broker matched the identifier in the consumer deletion list to the same identifier in the data broker's records but all of the personal information related to the matched consumer is exempt pursuant to Civil Code Section 1798.99.86 and therefore no personal information is deleted.
      4. (D) “Record not found” when the data broker did not find a match in the data broker's records after complying with the requirements contained in section 7613.

3. (c) If a data broker uploads the status of consumer deletion requests into the DROP manually, it must:

   1. (1) Report the status of deletion requests received in its previous access session before downloading a new consumer deletion list or lists; and
   2. (2) Upload the report in a machine-readable comma separated value (CSV) file in the same format as the downloaded consumer deletion list with the response codes added.

Note: Authority cited: Section 1798.99.87, Civil Code. Reference: Section 1798.99.86, Civil Code.

History

1. New section filed 11-6-2025; operative 1-1-2026 (Register 2025, No. 45).