Vancouver, Canada — In 2025, California’s Privacy Protection Agency (CPPA) delivered one of its most explicit statements yet that the state’s privacy laws have entered a new era of active, high-impact enforcement. Acting under the recently implemented Delete Act, the CPPA imposed a substantial fine on a U.S.-based data broker for repeated failures to comply with consumer deletion requests submitted through the state’s centralized portal.
This enforcement action, arriving less than a year after the Delete Act’s full provisions took effect, is widely viewed as a turning point in how the personal data industry will be regulated going forward.
The Delete Act, formally known as Senate Bill 362, became law in 2023 and entered into full enforcement on January 1, 2024. It created a first-of-its-kind centralized deletion mechanism for California residents. Instead of having to contact each data broker individually, consumers can now submit a single, verified deletion request through a portal operated by the CPPA.
That request is binding on all registered brokers in the state, who are required to remove the data within 45 days. The law goes further than previous statutes by including a “no re-acquisition” clause that forbids brokers from repurchasing, re-licensing, or otherwise re-obtaining the same consumer’s personal information from any source.
According to the CPPA’s enforcement notice in this landmark case, the broker in question failed on multiple counts. It did not complete deletions within the statutory period, was unable to remove specific categories of data entirely, and neglected to send confirmations to consumers who had exercised their rights. The company attempted to defend its failures by citing “technical delays” and “data mapping challenges.” The CPPA rejected these explanations outright, making clear that operational readiness is a non-negotiable obligation under the law.
For the data broker industry, which has long operated with minimal direct oversight, the fine represents both a compliance wake-up call and a preview of the kind of enforcement that could become routine as California fully commits to privacy protection.
Amicus International Consulting, a global advisory firm specializing in legal identity transformation, multi-jurisdictional compliance, and privacy risk mitigation, has responded by releasing a fully expanded Fast-Track Deletion Playbook for individuals and organizations. This detailed guide translates the legal rights created by the Delete Act into a practical, repeatable process for removing personal data from broker systems and keeping it out.
Why the Delete Act Is a Fundamental Shift in Privacy Law
California has been at the forefront of U.S. privacy legislation for more than a decade, beginning with the California Consumer Privacy Act (CCPA) in 2020 and its 2023 expansion under the California Privacy Rights Act (CPRA). While those laws allowed consumers to request deletion of personal data, the process was manual and time-consuming. A single request applied only to the company contacted, meaning that someone whose data was spread across hundreds of brokers faced an almost impossible task.
The Delete Act changes that calculus entirely. It removes the logistical friction that kept many people from exercising their rights and places the burden squarely on data brokers to maintain operational systems capable of executing deletions promptly. The “no re-harvest” rule closes a longstanding loophole by making it illegal for a broker to re-acquire data that it has deleted in response to a verified request.
The act’s centralized approach also creates new enforcement leverage for the CPPA. Because the agency operates the portal, it has a complete log of which brokers received requests, when they were received, and whether they responded on time. This makes compliance monitoring far easier than under prior frameworks.
The Amicus Fast-Track Deletion Playbook
Amicus has broken the deletion process into a structured five-stage methodology. This approach is designed for both individual privacy protection and corporate risk management when shielding executives, employees, or high-risk personnel from excessive exposure.
Stage 1: Pre-Request Data Mapping
Begin by consulting the CPPA’s public registry of data brokers. This list identifies every entity legally required to comply with the Delete Act.
Identify brokers most likely to hold your data. Consider your profession, online activity patterns, purchasing history, and any public records exposure.
Create a list of data categories that may be in circulation: residential addresses, phone numbers, family member names, professional affiliations, property ownership records, purchasing behavior, geolocation logs, and online browsing profiles.
Stage 2: Centralized Delete Act Request Submission
File your request through the CPPA’s secure portal, ensuring that all identity verification steps are completed to avoid rejections.
Use a dedicated, privacy-specific email address for this process to reduce linkage to other accounts and minimize the creation of new data trails.
Save both a digital and physical copy of your submission confirmation. Record the statutory 45-day completion deadline in your calendar.
Stage 3: Supplementary Broker-Specific Notices
While the centralized request is legally binding, Amicus recommends sending direct notices to high-risk brokers as an added enforcement measure.
These notices should reference the relevant sections of the Delete Act, outline the 45-day statutory requirement, and request written confirmation that deletion has been completed and that no re-acquisition will occur.
Stage 4: Verification and Compliance Audit
At the 45-day mark, begin auditing to confirm that data has been removed.
Use both automated scanning tools and manual search methods to check broker websites, people-search databases, and data aggregation services.
Pay special attention to “shadow databases” where brokers may store archived information that is technically removed from public view but still retained internally.
Document all findings with screenshots, timestamps, and URLs for potential submission to the CPPA if a complaint becomes necessary.
Stage 5: Re-Acquisition Monitoring
Schedule quarterly scans of major broker and aggregation platforms to ensure your deleted data has not reappeared.
If you detect re-harvesting, file an immediate complaint with the CPPA, including the original deletion request and your audit evidence.
Real-World Case Studies Demonstrating the Playbook in Action
Case Study 1: The Corporate Finance Executive
A CFO in San Diego preparing for a high-profile merger discovered her personal and family data on multiple broker platforms. She executed the Amicus playbook, including supplementary notices to 15 brokers known to serve corporate intelligence clients. Within 60 days, her records were removed from 90 percent of identified brokers. The CPPA fined two companies that ignored the request and failed to meet deadlines.
Case Study 2: The Harassment Survivor
A Sacramento resident dealing with repeated stalking incidents filed a centralized deletion request covering all registered brokers. Most complied, but three brokers missed the statutory deadline. Amicus assisted in filing detailed CPPA complaints. The agency fined one broker and issued compliance orders to the others.
Case Study 3: The Relocating Entrepreneur
A Los Angeles business owner moving her e-commerce operations to Europe used the Delete Act as part of a larger privacy overhaul. She paired CPPA deletion requests with GDPR erasure rights in the EU and suppression of public records in U.S. jurisdictions. The result was a significant reduction in her visibility to competitors and identity thieves.
Case Study 4: The Political Strategist
An Oakland-based campaign advisor used the Delete Act to remove personal addresses and political contribution records from broker databases during a contentious election cycle. The deletion was completed in 43 days, and no re-acquisition was detected in six-month follow-up scans.
Case Study 5: The Health Industry Whistleblower
A nurse who had testified in a major healthcare fraud case feared retaliation and targeted harassment. Using the Delete Act, she erased her home address, phone number, and family details from more than 300 brokers. This action was coordinated with her legal counsel and the employer’s security team, significantly reducing her exposure.
Jurisdictional Intersections and Global Strategies
While the Delete Act applies specifically to California residents and registered brokers, its effects can be multiplied when combined with other privacy frameworks:
Colorado, Virginia, and Connecticut offer deletion rights but require separate requests. Residents with California connections can use the Delete Act to extend protection across multiple states.
European Union GDPR gives residents and citizens a “right to erasure” that applies globally to companies handling EU personal data. Pairing this with the Delete Act can create overlapping obligations that are harder for brokers to ignore.
Canada’s forthcoming Consumer Privacy Protection Act (CPPA) will offer similar rights, providing another enforcement pathway for individuals with cross-border exposure.
Amicus advises high-risk individuals and global organizations to create a layered deletion strategy that coordinates actions across all applicable jurisdictions.
The Risks of Incomplete or Superficial Deletion
Brokers have been known to use tactics that technically comply with the letter of deletion laws while undermining their intent:
Moving records into “inactive” databases without actually destroying them
Retaining partial profiles, such as names without addresses, which can later be re-linked
Passing data to foreign affiliates not directly covered by U.S. laws
These risks underscore why deletion must be treated as an ongoing process. Continuous monitoring is the only way to ensure long-term compliance.
Amicus Recommendations for High-Risk Profiles
Combine Delete Act requests with removal from major people-search engines and property record sites.
Use alternate addresses or corporate registration agents for public filings.
Update core personal contact information after deletion to aid in detecting re-harvesting.
Consider legal name change strategies when dealing with severe, ongoing threats.
Enforcement Outlook
The CPPA has made clear that “technical difficulty” is not a defense. The law authorizes fines of $200 per violation per consumer, which can quickly reach six- or seven-figure sums when multiplied across large datasets. In severe cases, the agency may refer matters for criminal investigation.
As consumer awareness grows, deletion requests are expected to surge, placing operational strain on brokers. Analysts predict some smaller brokers will exit the industry rather than absorb compliance costs. For those that remain, the Delete Act will require a fundamental restructuring of data collection, retention, and resale practices.
Conclusion
The Delete Act has shifted the privacy power dynamic in California, giving individuals unprecedented leverage over the data broker industry. For consumers, it is an opportunity to reclaim control of personal information on a scale that was previously impossible. For brokers, it is a mandate for operational transformation with significant penalties for those who fail to adapt.
Amicus International Consulting’s Fast-Track Deletion Playbook translates the statutory rights of the Delete Act into a precise, enforceable, and repeatable privacy protection strategy. By combining legal authority with practical auditing and monitoring, individuals and organizations can turn a one-time deletion into an enduring shield against unwanted data exposure.
Contact Information
Phone: +1 (604) 200-5402
Email: [email protected]
Website: www.amicusint.ca
