Authorized Agents Under the California DELETE Act: DROP Rules

Under California’s DELETE Act, an authorized agent may help a California resident submit and track a DROP deletion request. The resident must first pass residency verification; the agent must be authorized and identified, and cannot cancel the request without express direction.

DELETE Act and DROP are different things

The DELETE Act is the law enacted through SB 362. DROP is the Data broker Requests and Opt-out Platform, the internet service created by the California Privacy Protection Agency (CPPA), operating publicly as CalPrivacy, to implement the law’s centralized deletion mechanism. The California DELETE Act overview explains the wider statutory structure.

The distinction matters for agents. Civil Code section 1798.99.86 requires the mechanism to support a consumer’s authorized agent in aiding with a deletion request. It also requires the mechanism to let the consumer or authorized agent verify the request’s status. The effective DROP regulations then specify how an agent participates in the platform.

DROP is limited to requests directed through the state mechanism to data brokers subject to that system. It is not a universal account from which an agent can exercise every California privacy right against every business. Whether an organization is legally a data broker turns on the statutory definition and exclusions, not merely the ordinary meaning covered in an introductory guide to what a data broker is.

Who qualifies as an authorized agent

The current CCPA regulations, section 7001(d), define an authorized agent as a natural person or a business entity that a consumer has authorized to act on the consumer’s behalf, subject to section 7063. That definition can cover an individual helper or an organization. Merely offering assistance, knowing the consumer, or possessing the consumer’s identifiers does not create authorization.

The DROP terms of use apply that definition to people aiding another consumer through the platform. They state that the other person must have authorized the agent, that the agent must satisfy title 11, section 7001(d), and that the agent certifies both the authorization and the truth and correctness of submitted information. The terms prohibit adding information about someone who has not provided authorization.

Authorization is not the same as residency verification

Authorization establishes why the agent may act. Residency verification establishes whether the consumer is eligible to use DROP. They are separate requirements. Under sections 7620 and 7621 of the DROP regulations, the consumer must have California residency verified by the Agency before an authorized agent may aid with the deletion request. The rule therefore does not allow an agent’s identity, residence, or business location to substitute for verification of the consumer.

CalPrivacy’s DROP help page confirms that a person may submit for someone else with that person’s permission and should follow the instructions inside DROP. The current interface, rather than an assumed off-platform process, should control what the consumer and agent must enter.

Security and permitted use of the consumer’s information

Section 7063 of the current CCPA regulations requires an authorized agent to maintain reasonable security procedures and practices for the consumer’s information. It also prohibits using information collected from or about the consumer for purposes other than fulfilling the consumer’s requests, verification, or fraud prevention.

Those obligations are relevant when an agent receives names, dates of birth, contact details, account information, or device identifiers. Authorization is not permission to reuse those details for advertising, unrelated profiling, lead generation, or another person’s request.

DROP-specific rules for authorized agents

The agent provisions are short, but each condition has a distinct function.

These rules describe aid with a consumer’s request, not the creation of an agent-owned batch containing multiple people. The DROP terms prohibit adding personal information about multiple people in the same request. Each consumer’s authority, eligibility, information, and request must remain separate.

DROP requests versus direct CCPA requests

A DROP submission is a specialized consumer request. A direct CCPA request is sent to a particular business to exercise an applicable right, such as deletion, correction, knowledge, or an opt-out. The broader California privacy-law guide provides context for those rights, but the procedures should not be blended together.

For a direct request to delete, correct, or know, CCPA regulation 7063 permits the receiving business to require proof that the consumer gave the agent signed permission. The business may also require the consumer to verify identity directly or confirm directly that the agent has permission, but it may not require the consumer to resubmit the request personally. Those provisions do not apply when the consumer has given the agent a qualifying power of attorney under the cited California Probate Code provisions, and a business cannot require power of attorney as the only way to use an agent.

The DROP-specific rule is framed differently. Section 7621 requires prior residency verification and disclosure of the agent’s identity through the consumer’s account; it does not itself describe a signed-permission upload to the Agency. At the same time, the current platform terms refer users to the general authorized-agent definition and require a certification of authorization. An agent should therefore follow the live DROP prompts and retain reliable evidence of the consumer’s directions without assuming that a direct business’s verification procedure is also the DROP procedure.

The difference continues after submission. Data brokers receive requests through DROP and perform matching under the platform regulations; section 7616 states that a broker must not contact a consumer to verify a DROP deletion request. A direct CCPA request may involve direct identity verification under the separate CCPA rules. This is why a response from one channel should not be treated as proof that the requirements of the other channel were satisfied.

Practical checklist for consumers and agents

The following checklist combines express rules with cautious recordkeeping practices. It does not replace the current platform instructions.

1. Define the assignment in writing: identify the consumer, the DROP deletion request, whether the agent may submit information, whether the agent may view status, and whether any later amendment is authorized.
2. Have the consumer complete the residency-verification stage required by section 7620. Do not substitute the agent’s address, account, or identity.
3. Use a separate request for each consumer. Do not combine family members, clients, or household members in one profile under the DROP terms.
4. Enter only accurate consumer information relevant to matching. Do not infer an identifier, reuse information from another file, or add data the consumer has not approved.
5. Disclose the agent’s full name, email address, and applicable business trade name through the consumer’s DROP account before submission, as section 7621(b) requires.
6. Protect any information received from the consumer and restrict its use to the request, verification, or fraud prevention, consistent with section 7063.
7. Preserve the authorization and a neutral record of actions taken. Keep the scope clear if the consumer later changes instructions.
8. Do not cancel the DROP request without the consumer’s express direction. Record that direction separately if cancellation is requested.
9. Use the official status function only within the authority the consumer granted. A broker-reported status does not enlarge the agent’s authority or establish a right to use the consumer’s data elsewhere.

What authorized-agent status does not guarantee

An authorized agent does not guarantee that a broker will find a matching record or that every item associated with the consumer will be deleted. The DELETE Act preserves specified exceptions, and the DROP regulations distinguish outcomes such as a deleted record, an opt-out when an identifier maps to multiple consumers, an exempt record, and no record found. Those outcomes concern broker matching and legal coverage, not whether the agent was useful or properly authorized.

Agent status also does not expand DROP to first-party data or to entities outside its coverage. A consumer may need a separate direct request when the objective is access, correction, deletion of information collected in a first-party relationship, or another CCPA right. The governing law, current regulations, business involved, information source, and facts of the request determine the available route.

This article provides general information, not legal advice. A dispute about the validity or scope of an authorization, power of attorney, residency, statutory coverage, or a particular response should be evaluated under the current official text and the relevant facts.