A person files an opt-out with a people-search site, gets a confirmation, and finds the listing back a month later. The site took the request, deleted the listing, and rebuilt it from a fresh data purchase. The opt-out worked. The business model worked faster.
California's Delete Act was written for exactly this loop, and in 2026 it started biting. The fines are not hypothetical anymore. They are per request, per day, and the first settlements are public.
LocateSmarter paid 116,490 dollars in August 2026. Cybba paid 52,400 dollars. SalesIntel paid 36,400 dollars on September 1, 2026. The amounts are small against a broker's revenue, but the structure is what matters: 200 dollars a day for failure to register, and 200 dollars per deletion request per day for failure to comply. A broker that ignores a thousand requests for a month owes 6 million dollars, and the arithmetic is the enforcement.
The California Privacy Protection Agency's Enforcement Advisory 2025-01, issued December 17, 2025, set the terms: brokers have to register, have to check the Delete Request and Opt-out Platform at least every 45 days since August 1, 2026, and have to delete the information within 45 days of the request. Registration is due January 31 every year.
A broker that deletes your listing and then buys a fresh dataset containing your name, address, and phone number will rebuild the listing unless it checks the deletion list first. The Delete Act requires the check: brokers must consult DROP at least every 45 days and suppress the records of people who opted out. A broker that rebuilds without checking is violating the Act, and the violation is per request, per day.
The practical test for a resident is simple. File through DROP, wait 45 days, search your name, and screenshot what you find. If the listing is back, file a complaint with the Agency and cite the request date. The complaint is the enforcement mechanism. The Agency does not audit brokers on its own.
The Delete Act covers California residents, but the brokers it regulates sell data nationally, so a non-resident benefits indirectly when a broker cleans up its process. For a non-resident, the direct route is still the paid removal services, which file opt-outs broker by broker, and the state privacy laws in Colorado, Connecticut, Virginia, and the other states that now have their own deletion rights.
The long-term direction is clear. The fines are per request per day, the registration deadline is annual, and the Agency has shown it will settle. A broker that treats opt-outs as optional is betting against arithmetic that gets worse every year.
Keep reading: Your Opt-Out Did Not Stick: Why Brokers Re-List You in 3 to 6 Months, Removing Your Phone Number From People-Search Sites: The Number That Keeps Coming Back, Your Address Is in Google Results: Results About You and the Form Behind It cover the nearby cases in this series.
LocateSmarter paid 116,490 dollars in August 2026, Cybba paid 52,400 dollars, and SalesIntel paid 36,400 dollars on September 1, 2026. The penalties run 200 dollars a day for failure to register and 200 dollars per deletion request per day.
A California resident files one deletion request through DROP and it goes to every registered broker. Brokers must check the platform at least every 45 days since August 1, 2026, and delete the information within 45 days of the request. Registration is due January 31 every year.
Brokers rebuild records from fresh datasets. The Delete Act requires brokers to check DROP every 45 days and suppress opted-out records. A broker that rebuilds without checking is violating the Act, per request per day.
Indirectly, yes, because the brokers it regulates sell data nationally and clean up their processes across the board. Directly, use the paid removal services and your own state's deletion rights, which now exist in Colorado, Connecticut, Virginia, and others.