What California actually requires of you

Written for the person who has to do this — an owner or ops manager at a company that buys or sells leads or marketing data, with no privacy team and no engineer. Every step, in order, with honest time estimates.

Step 0 — Work out whether this is you

Nobody writes to tell you. The state does not send a letter, does not sign you up, and does not warn you. You are expected to read the definition, decide it describes you, and register yourself. Every fine issued so far has been against a company that failed this step.

The test that catches most people is the direct relationship one. If a person filled out a form on a comparison site, or on a partner's landing page, and you bought that lead — they never dealt with you. That's an indirect relationship, and it puts you in scope even though a form was filled out somewhere.

Free 2-minute check → covering California, Texas, Vermont and Oregon. No email required.

Step 1 — Register with the state about an hour, once a year

California registration runs January 1–31 each year and currently costs $6,000, rising to $9,500 for 2027. Texas ($300), Vermont, and Oregon ($600) have their own registries with their own deadlines. Connecticut opens in January 2027 and New Jersey in April 2027.

Registering also creates your login to the state's deletion portal, which you need for everything below. Note the portal gives each company a single login — there is no way to give your colleague their own account.

Step 2 — Download the state's list 2 minutes, every 45 days

You log into the portal and download a file. Here is the part that surprises everyone: the file contains no names. To protect people's privacy, the state converts each person's details into a scrambled code — a long string of characters that cannot be turned back into a name, an email, or a phone number.

So you cannot open the file and read who wants deleting. You genuinely can't. Which leads directly to the hard part.

Step 3 — Find those people in your data the hard part

To find out whether one of those scrambled codes is someone in your database, you have to scramble your own records using exactly the same method and compare the results. Same person, same method, same code — that's a match.

"Exactly the same method" is doing a lot of work in that sentence. The state publishes precise rules: phone numbers keep only the last ten digits, ZIP codes drop leading zeros before being shortened, names have accents flattened and punctuation stripped, and combined codes (name plus date of birth plus ZIP) are built by scrambling each piece separately and then scrambling the joined result — in a specific order.

Step 4 — Delete what matched varies — this is your work

Delete those people from your systems: the CRM, the dialer, the marketing platform, the spreadsheets, the backups. The law also expects you to pass the instruction on to any vendor you shared that data with — enrichment providers, agencies, list partners — and it is on you to be able to show you did.

Step 5 — Tell the state what you did 5 minutes

There are only four possible answers for each request:

You upload one file with your answers, in a strict format that rejects anything slightly off. One catch worth knowing: if individual rows are rejected, the state does not tell you in the upload — it emails the address you registered. If nobody reads that mailbox, you will believe a round succeeded when it didn't.

Step 6 — Keep the "not found" people forever

This is the obligation people miss entirely. Everyone you answered not found has to be recorded permanently — and every time you buy a new list or collect new records, you must check the newcomers against that record and remove anyone on it before you sell or share the data.

In other words: someone who asked to be deleted stays deleted, even if you acquire them again next year from a completely different source. That's a permanent block list, not a one-off task.

Step 7 — Do it again in 45 days. Forever.

There is no end date. The clock restarts from each download, and independent audits begin in January 2028 — examining not just whether you filed, but how you did the matching, what you deleted, and what your block list looks like. The first certifications are due April 2029, so the records you keep this month matter years from now.

What it costs to get wrong

$200 per deletion request, per day, with no grace period — plus a separate $200 per day just for not being registered. Fourteen companies have been penalised so far, including fines of $110,490 and $52,400 in August 2026. Every one of those was for registration failures, because the deletion requirement only started in August. That wave hasn't landed yet.

Work out your own exposure →

What you need to have ready

• A login to the state's deletion portal (you get this when you register)
• A way to export your contacts to a spreadsheet — most CRMs and dialers do this in a couple of clicks
• A way to delete records in bulk once you know which ones
• A list of the vendors you've shared data with
• Somewhere to keep the proof — for years, not months

You do not need a developer, an API, or an integration. The whole cycle can be done by downloading and uploading files.

This is a plain-English summary for orientation, not legal advice. Whether you qualify as a data broker, and whether a particular record is exempt, are legal judgments — take advice on both.