California probes data-broker audits
California’s privacy regulator is now seeking feedback on draft rules that would require data brokers to audit compliance with state data-deletion requirements. The California Privacy Protection Agency’s consultation signals tighter scrutiny of third‑party data collectors and how they handle deletion requests under state law (news.bloomberglaw.com). For K–5 STEAM programs that use apps and platforms, the move underscores regulatory momentum toward greater transparency in vendors’ data practices (news.bloomberglaw.com).
California is asking a deceptively simple question: when a data broker says it deleted your data, how would anyone prove it? On April 8, 2026, the California Privacy Protection Agency opened a comment process on draft audit rules for the state’s Delete Request and Opt-Out Platform, or DROP. (cppa.ca.gov) The target is the data-broker industry, which California defines as businesses that knowingly collect and sell personal information about people they do not have a direct relationship with. Think of companies that trade in names, addresses, location clues, and profile data even though you never signed up with them. (cppa.ca.gov) This did not start with the new audit idea. Governor Gavin Newsom signed Senate Bill 362, called the Delete Act, on October 10, 2023, and the law moved oversight of data brokers from the California attorney general to the California Privacy Protection Agency starting January 1, 2024. (skadden.com) The law’s core promise is a one-stop delete button. California built that system as the Delete Request and Opt-Out Platform, and the agency said in November 2025 that consumers would be able to submit delete requests through it starting in January 2026. (cppa.ca.gov) The next deadline is August 1, 2026. From that date, data brokers must check DROP at least once every 45 days, pull any new requests, and delete matching personal information unless a legal exception applies. (cppa.ca.gov) California already requires brokers to keep the deletion going, not just do it once. The November 2025 rules say brokers must report the status of each request within 45 days of retrieving it and maintain a list of deletion requests so the same person’s data does not quietly flow back in later. (cppa.ca.gov) The new consultation is about the part after that: auditing the claim. The Delete Act says that beginning January 1, 2028, and every three years after, each data broker must undergo an independent third-party audit to test compliance with the deletion rules. (cppa.ca.gov) The agency’s questions show where it thinks the weak spots are. It wants input on auditor independence, what records would prove a broker standardized and hashed data correctly, how brokers matched records, what they kept on suppression lists, and whether special audit methods are needed when artificial intelligence systems are involved. (cppa.ca.gov) One especially revealing detail is identifiers. California says it currently collects only zip codes from consumers for this matching process, and it is asking whether fuller identifiers such as a full address or Internet Protocol address would produce more matches between consumer requests and broker files. (cppa.ca.gov) This is landing after California spent 2024 and 2025 turning data brokers into an enforcement priority. The agency announced an investigative sweep in October 2024, and by November 2025 it said it had launched a dedicated Data Broker Enforcement Strike Force and brought multiple actions against unregistered brokers. (privacy.ca.gov) (cppa.ca.gov) For schools and K-5 STEAM programs, the immediate issue is not that classroom apps are automatically data brokers. The issue is that any vendor chain that depends on outside data collection, resale, enrichment, or opaque third-party matching is moving into a world where California wants logs, evidence, and independent checks instead of promises. (cppa.ca.gov 1) (cppa.ca.gov 2)
