California's DELETE Act: The August 1, 2026 DROP Deadline and the GLBA Exemption Test Every Fintech Needs to Pass

TL;DR

• Since August 1, 2026, California’s DELETE Act has required registered data brokers to process consumer deletion requests through the DROP system. The penalty is $200 per deletion request per day, and the statute has no cure period
• By August 25, more than 500,000 Californians had signed up for DROP, but only about a quarter of the 654 registered brokers had reported processing deletion requests
• The data broker definition excludes an entity “to the extent that it is covered by” the GLBA. That requires confirming your fintech actually qualifies as a GLBA-covered financial institution, and it doesn’t automatically cover non-GLBA activity
• Many fintechs operate in financial services without meeting the GLBA financial institution definition: data aggregators, lead generators, and analytics companies in fintech are often NOT GLBA-covered
• The analysis every fintech needs to run today: (1) Are we GLBA-covered? (2) If not, do we collect and sell personal data about consumers we don’t have a direct relationship with? (3) Should we be registered as a California data broker?

Updated October 22, 2026: the August 1 deadline has passed. This post now reflects the live obligation, early DROP numbers and the statute’s exact GLBA wording.

August 1 Was Not a Grace Period

California’s DROP system, the Delete Request and Opt-Out Platform, launched in January 2026 as a centralized consumer portal. On August 1, 2026, that launch phase ended and the compliance obligation began: registered data brokers must access the platform at least once every 45 days to retrieve deletion requests and process them.

The penalty for non-compliance: an administrative fine of $200 per deletion request for each day the data broker fails to delete the personal information as required by the Delete Act, plus the agency’s investigation costs. The California Privacy Protection Agency brings these cases as administrative actions, and the statute contains no cure period.

Consumers showed up. CalPrivacy reported on August 25, 2026 that more than 500,000 Californians had signed up for DROP, with 654 brokers in the system, and that only about 25% of brokers had reported processing deletion requests since the August 1 deadline. The agency has also kept up its registration enforcement: on August 11, 2026 it ordered Iowa data broker LocateSmarter LLC to pay $116,490 for late registration and for requiring partial Social Security numbers before consumers could opt out.

For organizations that are clearly registered data brokers and clearly not GLBA-covered, this deadline was visible for well over a year. The harder question — and the one many fintechs haven’t fully worked through — is whether the GLBA exemption actually applies to them.

What the DROP System Does

DROP is a consumer-facing tool. A California resident submits one deletion request through the CPPA’s portal. That request is distributed to every registered data broker in the system. Since August 1, data brokers must:

1. Access the platform at least once every 45 days
2. Retrieve all pending deletion requests
3. Search their records for each requesting consumer
4. Delete all associated personal information, including inferences, where a match is found, within 45 days of receiving the request
5. Direct their service providers and contractors to delete the same information
6. Process requests that can’t be verified as opt-outs of sale or sharing
7. Report request status back through the system
8. Maintain documentation of retrieval and deletion actions

The scope of “delete” is broader than some organizations expect: it includes derived data and inferences, not just raw personal information collected about the consumer. A data broker that compiled a behavioral profile from aggregated third-party data sources would need to delete the profile as well as the underlying data.

Who Is (and Isn’t) a Data Broker Under the Delete Act

The California Delete Act defines a “data broker” as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.

The operative element is the absence of a direct consumer relationship. This matters for how the test applies to different business models:

The statute also excludes entities to the extent they are covered by the FCRA or California’s Insurance Information and Privacy Protection Act, and HIPAA covered entities and business associates to the extent their processing is exempt under Civil Code 1798.146. For financial services, the primary exclusion is the GLBA.

The GLBA Exemption: Who Actually Qualifies

The Delete Act excludes from the data broker definition “an entity to the extent that it is covered by the Gramm-Leach-Bliley Act” and its implementing regulations. This sounds broad (financial services companies assume they’re covered), but it has a specific legal meaning, and the “to the extent” wording means it doesn’t automatically reach activity that falls outside GLBA.

A “financial institution” under GLBA is a company that is “significantly engaged in financial activities.” The Federal Trade Commission’s Safeguards Rule and Privacy Rule cover:

• Banks, savings associations, and credit unions
• Mortgage companies and brokers
• Securities broker-dealers and investment advisers
• Insurance companies
• Payday lenders and consumer finance companies
• Tax preparers
• Travel agencies in connection with financial services
• Companies providing financial data processing

What’s notably not on that list: pure technology companies, SaaS platforms, data analytics firms, and marketing platforms — even if their customers are financial services companies. A company that provides software to banks isn’t itself a GLBA financial institution. A company that sells marketing data to credit card companies isn’t GLBA-covered by virtue of its customers.

The question your legal team needs to answer: Does your company meet the statutory definition of a GLBA financial institution, or do you operate in financial services adjacent capacity?

The failure mode: a fintech assumes it’s GLBA-covered because it handles financial data, partners with banks, or calls itself a “fintech.” None of those facts determine GLBA coverage. What determines it is whether the company itself is “significantly engaged in financial activities” as defined by GLBA.

The Three Categories of Fintechs and What Each Should Do

Category 1: Clearly GLBA-covered financial institutions. Banks, credit unions, licensed mortgage companies, registered investment advisers, insurance companies, licensed consumer lending companies. These entities are excluded from the data broker definition to the extent they are covered by GLBA. You should document this determination in your privacy compliance records. For core GLBA activity you’re not required to register as a data broker or access DROP. But if any business line buys and resells personal information about consumers you have no direct relationship with, analyze it separately, and you also have CCPA obligations for non-GLBA data.

Category 2: Clearly not GLBA-covered and clearly data brokers. Data aggregators that compile consumer financial profiles and sell them. Lead generation companies that collect consumer information without a direct consumer relationship. Marketing analytics companies. Financial data resellers. If this describes your business and you’re not registered, you’ve been out of compliance with the registration requirement since January 31, and with the deletion requirement since August 1. The path forward: register with the CPPA, set up your DROP account and access protocols immediately, and build deletion request workflows into your data infrastructure.

Category 3: Uncertain — fintechs in the gray zone. This is the most common and most unresolved position. You’re a fintech that handles financial data, potentially has some GLBA-like obligations under your bank partner’s program agreement, but hasn’t formally determined whether you’re a GLBA financial institution. Or you have multiple business lines, some of which look like financial institution activity and some of which look like data services.

For Category 3 companies, the analysis should already be done. If it isn’t, it can’t wait any longer. The risk of getting this wrong runs in both directions: if you’re a data broker and you don’t comply, you’re accumulating $200-per-request-per-day liability. If you’re exempt and you spend resources on DROP infrastructure you don’t need, that’s a resource waste with no upside. Get a definitive legal determination.

What the Data Mapping Exercise Looks Like

Whether you’re working through the GLBA determination or confirming your data broker obligations, the underlying exercise is the same: map your data flows to understand what personal information you collect, from whom, and what you do with it.

For DELETE Act compliance specifically, you need to answer:

• What personal information do we collect about individuals who are NOT our direct customers or end users?
• Do we sell or share that information with third parties?
• If yes, are we registered as a California data broker?
• Do we have technical infrastructure to receive, process, and respond to deletion requests through DROP?

The data mapping tool inside a privacy compliance program gives you the inventory. The legal determination gives you the categorization. Together they tell you whether DROP access is an obligation for you or not.

So What?

California’s DELETE Act and the DROP system aren’t new: the law passed in 2023, the DROP regulations took effect January 1, 2026, and the DROP portal launched in January 2026. August 1, 2026 is when the compliance obligation became operational and the penalty clock started.

Most GLBA-covered financial institutions have correctly identified the exclusion and have not registered as data brokers. The exposure sits in the middle tier: fintechs that haven’t done the formal GLBA determination, companies with mixed business models, and data-adjacent services that assumed “financial services” was synonymous with “GLBA-covered.”

If you still haven’t confirmed your status, do it now. Knowing whether you should have registered months ago is the first step toward managing whatever liability may exist, and with a 45-day access cycle, every missed cycle adds exposure. The statute offers no cure period, but an organization that identifies a compliance gap, registers promptly, and builds DROP access demonstrates good faith in a way that an organization that ignores the deadline cannot. Also note that SB 923, signed in September 2026, broadens the CCPA right to delete to cover information a business obtained from third parties starting January 1, 2027, so the deletion workflow you build for DROP will get more use.

For privacy compliance programs managing multiple overlapping state laws — and fintechs are managing an increasing number of them — the data broker determination should be a standing element of your annual privacy risk assessment, not a one-time analysis. State definitions of “data broker” are evolving. The GLBA exemption landscape is also shifting as Montana and Connecticut have already modified their entity-level exemptions. Document the determination now, and build a review cadence that catches when the facts or law change.

Sources:

• Delete Act statute, Civil Code 1798.99.80–1798.99.89 (effective January 1, 2026) — California Privacy Protection Agency
• Data Broker Registration and Accessible Deletion Mechanism regulations — California Privacy Protection Agency
• Half a Million Californians Have Signed up for DROP (August 25, 2026) — CalPrivacy
• CalPrivacy Brings First Action Against a Data Broker Under Both the CCPA and Delete Act (August 11, 2026) — CalPrivacy
• California Expands Privacy Protections by Strengthening Deletion Rights (SB 923) — CalPrivacy