Policy Briefing — California Delete Act universal deletion build reaches final design sprint
California’s Delete Act requires the CPPA’s centralized deletion mechanism and broker integrations to be production-ready by 1 January 2026, leaving Q4 2025 to finish API onboarding, identity proofing controls, and annual certification evidence.
Executive briefing: California Senate Bill 362 (the Delete Act) mandates that the California Privacy Protection Agency (CPPA) deploy a statewide deletion mechanism by 1 January 2026. Registered data brokers must connect to the platform, honour verified erasure requests within 45 days, and submit annual compliance attestations. With the CPPA sandbox opening in late 2025, October is the final opportunity to close identity verification, suppression orchestration, and evidence management gaps before cutover.
Statutory obligations
- Mechanism integration. Civil Code §1798.99.86 requires brokers to accept deletion requests routed through the CPPA system, confirm suppression across affiliated entities, and document completion within the 45-day window.
- Registration and reporting. Annual broker registrations move to the CPPA on 31 January 2026, demanding updated contact details, opt-out metrics, and explanations of data collection practices.
- Certification. Beginning in 2026, brokers must submit yearly compliance certifications describing policies, training, and third-party controls, with penalties of up to $200 per day for failure to comply.
Program actions
- Technical integration. Align engineering teams with CPPA API specifications, build automated suppression pipelines, and test acknowledgements, retry logic, and exception handling.
- Identity verification. Implement risk-based proofing flows that respect statutory limits on additional data collection while deterring fraudulent deletion requests.
- Evidence management. Centralise audit logs, broker registry updates, and suppression attestations to support annual certifications and Attorney General inquiries.
Enablement moves
- Train commercial and data-sharing partners on the Delete Act’s prohibition against selling minors’ data and the requirement to extend deletions downstream.
- Simulate CPPA oversight by running table-top exercises that produce response plans, corrective action timelines, and executive sign-off.