The Fine Print: "Exempted" — Exempted Why?
The Fine Print is a twice-weekly series that reads California's privacy law from the consumer's side: what a word promises, what the text says, and what is left exposed.
Last week we went through each DROP status in turn (Your DROP Status, Decoded). One deserves a closer look: "Exempted," the only status that confirms a broker holds your information and says it is keeping all of it.
What the word promises
"Exempted" sounds settled, as though a rule was checked and the matter closed. The agency's definition is plain: the broker "has information about you but is permitted by law to keep all of it due to one or more statutory exemptions" (How DROP works).
The phrase to notice is "one or more." The status tells you that an exemption applied. It doesn't tell you which one. The Delete Act says the mechanism must let a consumer "verify the status" of a deletion request (Civ. Code §1798.99.86(b)(9)). With "Exempted," what you can verify is the outcome, not the reason for it.
What the text says
The Delete Act lets a broker skip deletion in two situations. The first is where it is "reasonably necessary for the data broker to maintain the personal information to fulfill a purpose described in subdivision (d) of Section 1798.105." The second is where "the deletion is not required pursuant to Section 1798.145 or 1798.146" (§1798.99.86(c)(2), leginfo).
Section 1798.105(d) lists eight purposes (leginfo):
- completing a transaction, providing a requested good or service, or performing a contract;
- security and integrity;
- debugging;
- exercising free speech, protecting another consumer's free speech, or exercising "another right provided for by law";
- complying with the California Electronic Communications Privacy Act;
- certain public or peer-reviewed research, with the consumer's informed consent;
- "solely internal uses that are reasonably aligned with the expectations of the consumer"; and
- complying with "a legal obligation."
Some of these are tied to a specific task, like finishing a transaction. Others, like a free-speech claim, are not. Under the DROP reporting rule, every one produces the same word.
That follows from how the reporting rule is written. Under the agency's DROP regulation, effective 1 January 2026, a broker reports a transaction identifier and one of four response codes for each request (Cal. Code Regs., tit. 11, §7614(b), regulation text). "Record exempted" is the code for when the broker matched you "but all of the personal information related to the matched consumer is exempt pursuant to Civil Code Section 1798.99.86 and therefore no personal information is deleted" (§7614(b)(2)(C)). The rule has no field for the reason.
What stays exposed
Two things stay out of view.
The reason for a full exemption. You learn that everything was kept, but not why, so you can't tell whether the exemption is tied to something that will end or to something that won't.
Partial exemptions. "Record exempted" covers only the case where all of your information is exempt. When a broker deletes some fields and keeps others under an exemption, the code that fits is "Record deleted." Proposed amendments presented to the agency's Board on 7 August 2026 would spell that out: "Data brokers shall report an identifier as 'deleted' when any personal information associated with a matched identifier is deleted, even if some of the personal information is exempt from deletion" (proposed §7614(b)(2)(A), Agenda Item 10 text). That text is a proposal, not adopted law. As drafted, though, "deleted" would cover both a full deletion and a partial one, and the code would not say which.
Compare the agency's general rule for deletion requests sent straight to a business under the CCPA. When a business denies such a request "in whole or in part," it must give the consumer "a detailed explanation of the basis for the denial," including any "exception to the CCPA," "unless prohibited from doing so by law" (tit. 11, §7022(f)(1), regulation text). The two systems were built for different jobs, and we are not suggesting one rule governs the other. The contrast is still worth seeing. One channel requires a detailed explanation, and the other offers four codes.
The case the other way
There are good reasons the code is short.
The exemptions were written by the Legislature, not invented by brokers. The statute also limits what a broker may do with what it keeps. Exempt data "shall only be used for the purposes described in paragraph (2) and shall not be used or disclosed for any other purpose, including, but not limited to, marketing purposes" (§1798.99.86(c)(3)). "Exempted" is not permission to keep selling.
Some reasons can't safely be given. A legal obligation or a security matter is exactly where a business may be "prohibited from doing so by law," which is the same limit the general CCPA rule builds in.
Four codes in a machine-readable file are workable across every registered broker, and each added field is one more place for error. The proposed audit rules would test whether a broker "applied exemptions correctly" (proposed §7632(e)(6)(C)). That is an outside check on exemptions, even if consumers never see its results directly.
A fix anyone could carry out
- For the agency: add one optional column to the response file for a reason category (a §1798.105(d) paragraph number, §1798.145 or §1798.146), and show it next to "Exempted" on the consumer's screen. A category reveals the kind of reason, not the facts behind it. If the proposed amendments move forward, consider a separate code for "deleted, some data retained" in place of folding partial exemptions into "deleted."
- For auditors and researchers: if exemption testing is adopted, publish aggregate rates by category. A count of how often each exemption is relied on would tell the public more than any single status.
- For you: if a broker shows "Exempted," you can use the CCPA's right to know. It lets a consumer ask a business that collects personal information about them for "the categories of personal information it has collected about that consumer" and "the specific pieces of personal information it has collected about that consumer" (§1798.110(a), leginfo). That shows what is held, though not why. Note the date and the status you saw.
For the definitions underneath all of this, see what the statute means by "delete". The proposed audit rules are explained here. For the wider question of who checks a reported status, see our working paper, Who Verifies the Status?
Sources, read 27 October 2026: California Privacy Protection Agency, How DROP works; DROP regulation text (effective 1 January 2026), §§7613–7614; proposed regulation text, Board Agenda Item 10, 7 August 2026, §§7614 and 7632; CCPA regulation text, §7022(f); Cal. Civ. Code §1798.99.86, §1798.105 and §1798.110 on leginfo.legislature.ca.gov.
Follow Sirveil on LinkedIn: https://www.linkedin.com/company/133457181 · Follow @Sirveil_AI on X.
Disclosure: Sirveil builds privacy verification tools, so we have a commercial interest in this subject.
Sirveil for business: sirveil.ai/for-business
NONE OF THIS CONSTITUTES LEGAL ADVICE.