California enacted AB 883, shortening the data broker DROP cycle to 30 days
AB 883 was signed on September 27, 2026 and takes effect January 1, 2027. Through December 31, 2026, California data brokers must access and process DROP requests at least every 45 days. Beginning January 1, 2027, AB 883 shortens that cycle to 30 days.
- Official source
- California Legislative Information ↗
- Jurisdiction
- California
- Publication date
- September 27, 2026
- Legacy Core review
- September 30, 2026 · Christopher Green
- Source checked
- September 30, 2026
- Affected sectors
- General Professional Services
- Effective date
- January 1, 2027
Summary
AB 883 was signed on September 27, 2026 and takes effect January 1, 2027. Through December 31, 2026, California data brokers must access and process DROP requests at least every 45 days. Beginning January 1, 2027, AB 883 shortens that cycle to 30 days.
Why it matters
This is primarily relevant to businesses that qualify as California registered data brokers. It is not a general duty for a typical small firm. Useful readiness pieces for a covered broker are assigned ownership, a recurring deletion workflow, evidence of processing, vendor coordination, and documented procedures. A Legacy Core credential does not demonstrate compliance with AB 883.
Recommended action
If you are not a registered California data broker, no action is required from this bill. If you are, read the chaptered text and confirm the 30-day cycle with qualified counsel before January 1, 2027.