The Fine Print: One Deletion Button, Two Kinds of Backup
The Fine Print is a twice-weekly series that reads California's privacy law from the consumer's side: what a word promises, what the text says, and what is left exposed.
In September, California enacted a law for judges and elected officials who want their personal information removed from data brokers. It's easy to read it as a separate, faster deletion system for public officials. It isn't. Officials use the same button as everyone else. The difference comes later, if a broker doesn't follow through.
What the word promises
DROP, the state's Delete Request and Opt-out Platform, offers every Californian the same thing: one request, sent to every registered data broker, and a status for each one. The Delete Act says the mechanism must let a consumer "verify the status" of that request (Civ. Code §1798.99.86(b)(9), leginfo). Earlier in this series we went through what each status means (Your DROP Status, Decoded) and what "Exempted" leaves unsaid (Exempted Why?).
AB 883 (Chapter 507, Statutes of 2026, approved 27 September 2026) keeps that promise the same for officials. The Secretary of State must tell state elected officials that they "may submit a request to delete that person's personal information pursuant to Section 1798.99.86 through the accessible deletion mechanism." Local filing officers, the Judicial Council and the State Bar must send the same notice to local officials and judges (AB 883, chaptered text, new Civ. Code §1798.99.86.5).
What the text says
The new section tracks the general rules closely. Deletion for officials is "subject to the limitations provided in Sections 1798.105, 1798.145, and 1798.146," the same exemptions that apply to everyone. A broker processes an official's request "by complying with Section 1798.99.86 and its implementing regulations."
The difference is enforcement. "The Attorney General, a county counsel, or a city attorney may bring a civil action, on behalf of a judge or elected official, against a data broker who violates Section 1798.99.86 with respect to the personal information of that judge or elected official." The relief available is declaratory relief, injunctive relief, reasonable attorney's fees and actual damages. If a court finds a willful violation, it "may award punitive damages." The section "shall become operative on July 1, 2027."
For everyone else, the Delete Act's penalty section describes "an administrative action brought by the California Privacy Protection Agency": "An administrative fine of two hundred dollars ($200) for each deletion request for each day the data broker fails to delete information as required" (§1798.99.82(d)(1), leginfo). Those fines go to the Data Brokers' Registry Fund (§1798.99.82(e)). The CCPA's own consumer lawsuit covers certain security breaches and "shall apply only to violations as defined in subdivision (a)" (§1798.150(c), leginfo).
(AB 883 also changes the broker's DROP cycle from 45 days to 30. The chaptered text doesn't state a separate start date for that change, so we treat its timing as unconfirmed. The Agency's How DROP works page still describes the cycle as "at least every 45 days.")
What stays exposed
So the two tiers aren't about deletion. They're about what happens after the status comes back.
For an official, from July 2027, a status that doesn't match what is still published can become a court case brought by a public lawyer, with damages on the table. For everyone else, the status screen is what you have, and enforcement belongs to the Agency. A broker that falls short faces administrative fines, and those go to a state fund rather than to the person whose data stayed up. The Agency's complaint page says plainly that it "doesn't represent individual consumers and cannot act as your attorney." Under the new section, a public lawyer can act "on behalf of" an official.
The new section also leaves one question open. A public lawyer bringing a case would need to show that an official's information was not deleted. The statute doesn't say how that showing is made or where the evidence would come from. That is the same question every consumer faces when they read a status.
The case the other way
There are good reasons for the difference.
Judges and officials can face particular risks when their home address is easy to find. On 27 October, the U.S. Court of Appeals for the Fourth Circuit decided a challenge to part of West Virginia's version of Daniel's Law (No. 25-2121, published opinion). The court recorded that "the parties here agree" that governments "have a compelling interest in enhancing the safety and security of such officials," and said West Virginia "was fully justified in attempting to regulate such speech." It held that the West Virginia provision "violates the First and Fourteenth Amendments" because, without a notice requirement, it was not the least restrictive means. It noted that notice before liability "is the way that Congress and virtually every other State has chosen" to narrow such laws. California's route for officials starts with a request through DROP. The opinion addresses West Virginia's text, not California's, and we draw no conclusion about how a court would view §1798.99.86.5.
A narrower group is also easier to defend. A damages claim for everyone could raise harder questions about speech, cost and litigation volume, and routing cases through public lawyers keeps the new route contained.
And the general tier is not nothing. Every Californian gets the same single request, and a fine of $200 per request per day can add up across a long list of requests.
A fix anyone could carry out
- For the Agency: the new section requires it to write informational material for officials and judges. Publish it where anyone can read it. If it explains how to check what a broker still shows after a status comes back, that advice is just as useful to everyone else. Report enforcement under §1798.99.82(d) in aggregate (actions brought and requests involved), so the general tier's backup is visible.
- For public lawyers: when the first §1798.99.86.5 cases are brought after 1 July 2027, describe in public how the remaining data was shown. A method of proof that works for a judge would work for anyone.
- For you: note the status and the date you saw it, and check the listing yourself. If they don't match, the Agency's complaint page is the channel it lists "if you feel like your consumer privacy rights have been violated by a business."
For what the statute means by "delete" in the first place, see this explainer. For the wider question of who checks a reported status, see our working paper, Who Verifies the Status?
Sources, read 30 October 2026: AB 883, chaptered text (Ch. 507, Stats. 2026), Legislative Counsel's Digest and new §1798.99.86.5; Cal. Civ. Code §1798.99.82, §1798.99.86 and §1798.150 on leginfo.legislature.ca.gov; U.S. Court of Appeals for the Fourth Circuit, No. 25-2121, published opinion (argued 15 September 2026, decided 27 October 2026); California Privacy Protection Agency, How DROP works and CCPA Complaints.
Follow Sirveil on LinkedIn: https://www.linkedin.com/company/133457181 · Follow @Sirveil_AI on X.
Disclosure: Sirveil builds privacy verification tools, so we have a commercial interest in this subject.
Sirveil for business: sirveil.ai/for-business
NONE OF THIS CONSTITUTES LEGAL ADVICE.