California proposes independent audits for data brokers from 2028

California proposes independent audits for data brokers from 2028

13 November 2026: California's privacy agency, CalPrivacy, has opened formal rulemaking to set how data brokers must be audited by independent third parties every three years beginning on 1 January 2028. The same package amends the rules on data broker registration and on the Delete Request and Opt-out Platform, known as DROP. Written comments are due by 5 p.m. Pacific time on 6 January 2027.

Not yet independently verified. We read the agency's announcement but could not extract text from the notice or the proposed regulations, so the audit requirements are summarised only as the announcement lists them. The page gives no start time or location for the hearing and no effective date for the rules. We will update this when it can be confirmed, and remove this note.

What the audit rules would cover

The audit duty comes from the Delete Act, and the announcement says the proposed regulations fill in how it works. They deal with five matters: the timing of audits, their scope, the qualifications and independence of the auditors, the evidence an auditor must gather, and what the audit report must contain. The agency's page gives no further detail on any of the five, and the text of the draft sits in a separate PDF.

For a data broker, the list shows where the detail will sit: who may audit, how independent they must be, and what proof they must collect. The exact tests are in the draft regulations, not in the announcement.

Changes to registration and DROP

The second half of the package amends existing rules. The announcement lists the areas touched: definitions, account creation on DROP, how deletion lists are selected, access obligations, the processing of deletion requests, upkeep of suppression lists, and status reporting. It describes the changes as clarified definitions, updated terminology and better internal consistency across the registration and DROP rules.

The announcement does not say whether any amendment adds or removes an obligation, so the draft text is the place to check. Brokers that already process deletion requests through DROP should read the processing and suppression-list sections of the draft against their current workflow.

Hearing, deadline and where the papers are

A public hearing is set for 6 January 2027, the same day comments close. The page lists neither a time nor a place; instructions for submitting comments and joining the hearing are in the notice. CalPrivacy publishes the notice, the proposed regulations and the supporting documents on its regulations page, and an event page exists for the hearing. All oral and written comments are subject to public disclosure, so a company that comments should expect the text to be public.

Anyone who wants updates as the rulemaking proceeds can subscribe through the agency's website. The announcement names no contact person, phone number or email address for the rulemaking; it points to the general contact page.

Who needs to read the draft

Three groups have a reason to read the proposed text before January: registered data brokers, the audit firms that would qualify to examine them, and software vendors whose products handle deletion requests on a broker's behalf. The announcement sets no date for the rules to take effect, so the 2028 start for audits is the only compliance date it gives.

Sources

• CalPrivacy: CalPrivacy releases notice of proposed regulatory action for Delete Request and Opt-out Platform audits, 13 November 2026