Cal. Code Regs. tit. 11, § 7615 – Requirements to Stop Accessing Deletion Requests from the DROP.

(a) If a business no longer meets the definition of a data broker, it must:
1. (1) Within 45 calendar days, notify the Agency through its DROP account that it no longer meets the definition of data broker and explain why. On a case-by-case basis, the Agency may request additional information to confirm that the business is no longer operating as a data broker.
2. (2) Delete the personal information provided by the Agency through the DROP no more than 30 calendar days after completing registration for the last calendar year during which it operated as a data broker, or after it has concluded its final audit in compliance with Civil Code section 1798.99.86, whichever is later.
3. (3) Deactivate its DROP account after complying with paragraphs (1) and (2) of this subsection.
(b) A business that has deactivated its DROP account must create a new DROP account prior to subsequently operating as a data broker.

Note: Authority cited: Section 1798.99.87, Civil Code. Reference: Sections 1798.99.80 and 1798.99.86, Civil Code.

1. New section filed 11-6-2025; operative 1-1-2026 (Register 2025, No. 45).