SIRVEILTMEST. 2025
calprivacydropdelete-actpublic-commentprivacy

Deleted Should Say What It Means: Our Comment to California's Privacy Board on 6 November

Ben TobinUpdated 4 min read

On Friday 6 November 2026, the California Privacy Protection Agency (CalPrivacy) Board meets at the CPUC Auditorium, 505 Van Ness Avenue, San Francisco. The public is welcome in person, on Zoom or by phone (agenda). One item deserves attention from anyone who cares how much control Californians have over their personal information: Agenda Item 5, the Agency's proposals for the 2027 legislative session.

Sirveil's founder and CEO, Ben Tobin, plans to speak in public comment on that item. Here is what we will say, and why.

What the Agency is proposing

Staff's memo of 12 October 2026 sorts its ideas into three tiers (Item 5 memo). At the top is a proposal to bar facial recognition and biometric collection in consumer wearable recording devices such as smart glasses. Next come priority areas for research in 2027: opt-in consent before personal information is used to train AI models, limits on facial recognition in license plate readers, advertising IDs people can find and reset, and clearer consent for the viewing data connected TVs collect. Staff also recommend continued support if two earlier bills return: AB 1542 on the sale of sensitive personal information, and SB 435 on the publicly available information exemption.

These are proposals for discussion. The memo asks the Board for direction; it does not commit the Agency to sponsor any of them.

Three proposals we support

Advertising IDs people can actually find. DROP, the state's Delete Request and Opt-out Platform, already lets Californians provide their advertising ID as an identifier, yet many people cannot find it in their device settings. Making the ID visible, resettable and deletable would let more of the half a million Californians who have signed up for DROP (CalPrivacy, 25 August 2026) use the identifier that follows them across apps and devices.

A narrower publicly available information exemption. Much of what people-search sites publish traces back to public records, and "publicly available" information sits outside the definition of personal information (Civ. Code §1798.140(v)(2)). While that exemption stays broad, a person can submit a deletion request and still find much of their profile online.

Opt-in before AI training. Information inside a trained model is hard to remove. Asking first is simpler for consumers, and clearer for businesses, than relying on deletion afterward.

One addition: deletion should say what it means

When a DROP request is processed, the data broker reports a status such as "Record deleted." Under California's regulations, "delete" can mean the information was permanently erased, deidentified or aggregated (Cal. Code Regs., tit. 11, §7613(b)(1)(C)). Those outcomes leave a person in different positions, yet the word on the screen is the same. We walked through each status in Your DROP Status, Decoded.

A status that names the method, whether set by regulation or by statute, would tell consumers what happened to their information. It would also give the independent audits that begin under the Delete Act in 2028 (Civ. Code §1798.99.86) a fixed claim to test, recorded at the time rather than reconstructed later.

The case the other way

A more detailed status has costs. Every new field is something each registered broker must build and report, and more words on a status screen can confuse as easily as inform. Deidentified and aggregated information is, by definition, no longer supposed to identify anyone, so a broker could fairly argue the consumer's practical position is the same either way. Those are reasonable points, and a short, fixed list of methods, rather than free text, is how we would try to meet them.

How to take part

Public comment is open to anyone, with up to three minutes per speaker on each item. The agenda, meeting materials, Zoom link and dial-in details are posted at cppa.ca.gov/meetings. If you care about how deletion works in California, Friday 6 November is a good morning to tune in.

For the statutory definitions underneath all of this, see what the statute means by "delete".

Sources, read 26 October 2026: California Privacy Protection Agency, meeting agenda and Item 5 memo for 5–6 November 2026; CalPrivacy news, 25 August 2026; Cal. Civ. Code §1798.99.86 and §1798.140.

Follow Sirveil on LinkedIn: https://www.linkedin.com/company/133457181 · Follow @Sirveil_AI on X.

Disclosure: Sirveil builds privacy verification tools, so we have a commercial interest in this subject.

Sirveil for business: sirveil.ai/for-business

NONE OF THIS CONSTITUTES LEGAL ADVICE.

Share this article

PostShare

Get privacy insights delivered

No spam. Unsubscribe anytime. We send one email per week with new guides and data broker news.

Related Articles

The Fine Print: Your DROP Status, Decoded

DROP results are arriving, and each broker now shows one of five words next to your name: Deleted, Exempted, Opted-out, Record not found or Pending. Each word is accurate. Each also promises a little more than the definition behind it. Here is what each one means in the agency's own words, what it leaves in place, and what you can do next.

5 min read

The First DROP Cycle Closes in Mid-September. Nobody Is Going to Email You About It.

Deletion obligations under California's Delete Act began on 1 August 2026. Registered data brokers must access DROP at least every 45 days, which puts the close of the first mandatory cycle in mid-September. Here is what happens in that cycle, what you will and will not be told, and what you can check yourself.

6 min read

You Asked California to Delete You. Here Is What the Statute Means by "Delete."

Most Californians who file a DROP request picture the same thing: their name gone from the companies that trade in it. The statute means something narrower, and the narrowing is done almost entirely by four definitions — who counts as a data broker, what counts as personal information, what counts as a sale, and what deletion permits a company to keep. None of it is hidden. All of it is worth reading before you decide the system failed you.

10 min read

Start protecting your personal data

Scan, verify, remove: Sirveil finds where brokers list you, you confirm which entries are yours, and your takedown requests are prepared, transmitted, and chased on your behalf — tracked end to end.

Get Sirveil

Available now on the App Store and Google Play.