California Privacy Protection Agency (CPPA) Accessible Deletion Mechanism Software solution

The California Privacy Protection Agency (Agency) is charged with protecting the consumer privacy rights of Californians under the California Consumer Privacy Act (CCPA). Its responsibilities include: (1) rulemaking (2) education; and (3) administrative enforcement of those rights. On October 10, 2023, the Governor signed Senate Bill 362, informally known as the Delete Act, into law, transferring administration and enforcement of the Data Broker Registry to the Agency as of January 1, 2024. The Delete Act also directs the Agency, to establish an ¿accessible deletion mechanism¿ that allows consumers to request from all data brokers the deletion of all non-exempt personal information related to the consumer through a single deletion request to the Agency starting January 1, 2026. This one-stop-shop deletion mechanism will make it easier for Californians to exercise their privacy rights. The Agency is seeking to build an online deletion mechanism that allows a consumer, through a single verifiable request, to instruct every data broker to delete any personal information of the consumer held by the data broker or its associated service provider or contractor. Beginning August 1, 2026, data brokers must be able to access the online deletion mechanism once every 45-days to review consumer deletion requests and process those requests. The online solution will support the Agency¿s enforcement role by providing monitoring and reporting capabilities of registered data brokers that fail comply with the Delete Act requirement, as well as allowing those data brokers to submit required information to the Agency.