California Data Brokers Face October 29 DROP Deadline

Businesses should prepare for heightened congressional investigations in 2027 if the 2026 midterms create divided government, including by assessing potential exposure and preparing for inquiries. California privacy regulators are also moving toward more operational oversight: data brokers using the DROP system must complete a deletion-request processing cycle by the applicable deadline, and new rules will require requests to be processed within 30 days starting Jan. 1, 2027. Businesses that operated as data brokers in 2026 must register with CalPrivacy during the 2027 annual registration period, with a $9,500 fee. CalPrivacy’s 2027 agenda includes automated decision-making, privacy risk assessments, cybersecurity audits, opt-out signals and enforcement, topics Executive Director Tom Kemp is scheduled to discuss in a Nov. 12 webinar.