California’s data broker rules went live on 1 August. Most cross-border privacy programmes have not noticed.

For many European privacy teams, the United States still appears on the compliance map primarily as a transfer destination.

The questions are familiar. Is the receiving organisation certified under the EU-US Data Privacy Framework? Does the UK Extension apply? If not, are appropriate safeguards in place? Has the transfer risk assessment been completed? Are the contractual arrangements current?

Those are necessary questions.

They are no longer sufficient.

On 1 August 2026, an important part of California’s Delete Act became operational. Data brokers are now required to access California’s Delete Request and Opt-out Platform, known as DROP, at least once every 45 days and process deletion requests submitted by California residents.

It is a state-level operational obligation that sits alongside the international transfer architecture many UK and European organisations already maintain.

And that distinction matters.

Adequacy gets the data into the US. It does not finish the analysis.

The EU-US Data Privacy Framework provides a mechanism through which personal data can flow from the EU to participating US organisations. The UK’s arrangements operate separately through the UK Extension to the EU-US Data Privacy Framework, a partial adequacy finding for qualifying US organisations.

For privacy teams managing international transfers, these mechanisms understandably occupy a large part of the US compliance conversation.

But adequacy answers a particular question: under what conditions can personal data be transferred to the recipient in the United States?

It does not answer every question about what happens once the data is there.

The ICO makes the point explicitly in its current guidance. The UK Extension is only a transfer mechanism. Organisations must still comply with the other applicable data protection requirements surrounding the processing.

The same principle should shape the wider US review.

A US entity can sit inside a perfectly defensible transfer architecture while separately creating obligations under US federal or state law because of what that entity actually does with personal information.

California is a particularly useful example of why those two layers should not be confused.

What changed on 1 August

California’s data broker regime is not new, but the operational significance of DROP is.

California defines a data broker, broadly, as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.

Data brokers have annual registration obligations with the California Privacy Protection Agency, CalPrivacy. DROP adds a centralised deletion mechanism for consumers.

California residents have been able to submit DROP requests since January 2026. From 1 August, registered data brokers became responsible for retrieving and processing them.

At least once every 45 days, a broker must access DROP, download the relevant consumer deletion lists, compare the hashed identifiers supplied through DROP with its own records, process matching requests and report the required status information.

The obligation is continuing rather than a one-off exercise. Where information is subsequently collected again, the deletion requirement can continue to apply.

That turns what could once have looked like a registration question into an operating process.

Someone has to determine whether the organisation falls within the definition. Someone has to own the DROP account. Systems and records have to support matching. Deletion has to propagate appropriately. Exceptions have to be understood. Statuses have to be reported. The process then has to run again.

For a multinational organisation, the important question is therefore not simply whether the parent company thinks of itself as a data broker.

It is whether any relevant entity or activity within its US footprint could bring the regime into scope.

The vendor problem is harder

The same issue arises with third parties.

A European privacy programme may have a mature vendor governance process that identifies international transfers, records the transfer mechanism, monitors Data Privacy Framework certification and maintains appropriate contractual safeguards.

But what does that process tell you about the vendor’s downstream use of California consumer information?

Potentially, not enough.

A vendor may receive personal data legitimately under an international transfer mechanism and still have its own obligations under California law arising from its business model and subsequent processing.

That does not mean every vendor becomes a data broker. Nor should privacy teams start labelling vendors as data brokers merely because they receive personal information.

It means the review needs a second question.

After asking “how can we lawfully transfer this information to the United States?” ask “what legal and operational obligations apply to the recipient because of what it does with the information once it receives it?”

Those are different assessments.

A cross-border programme that records the first and ignores the second has mapped the route but not necessarily the destination.

DROP is not the only California development to watch

The timing matters because DROP is becoming operational against a broader change in California privacy regulation.

The California Privacy Protection Agency’s regulations covering risk assessments and automated decision-making technology, or ADMT, took effect on 1 January 2026, although their compliance dates are not identical.

Businesses whose processing presents significant risk to consumers’ privacy are subject to the new risk-assessment requirements from 1 January 2026, with subsequent submission requirements to the Agency.

For ADMT, businesses using the technology to make significant decisions concerning consumers must comply with the specific ADMT requirements by 1 January 2027.

That distinction is important.

The lesson for a multinational GC or DPO is not that every California requirement arrived on the same date. It is almost the opposite.

The regulatory stack now contains obligations with different triggers, different compliance dates and different operational owners.

A transfer register alone is unlikely to reveal all of them.

A better US exposure review

For multinational organisations with US entities or vendors, the practical response is not to rebuild the entire privacy programme around every new state-law development.

It is to make sure the architecture can see them.

A useful review starts with six questions.

1. Which legal entities actually touch the data?

Do not stop at the contracted recipient. Map US subsidiaries, affiliates, service providers and other entities that receive or subsequently process the information.

2. What is the transfer mechanism?

Record whether the transfer relies on the EU-US Data Privacy Framework, the UK Extension, Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, another safeguard, or an applicable exception.

That remains essential. It simply should not be the end of the review.

3. What does the US recipient actually do with the information?

Distinguish processing on behalf of another organisation from activities undertaken for the recipient’s own purposes. Understand whether information is sold, shared, combined, enriched, licensed or otherwise disclosed.

That operational picture is what allows the organisation to identify whether additional US obligations may need investigation.

4. Could any entity fall within California’s data broker regime?

This should be assessed against the statutory definition rather than assumptions based on the organisation’s sector or how it describes itself commercially.

Where there is potential exposure, establish who owns registration, DROP processing and continuing compliance.

5. Are CCPA risk assessment or ADMT requirements relevant?

Identify processing that may trigger California’s risk-assessment regime and identify uses of ADMT that make significant decisions concerning consumers ahead of the 1 January 2027 compliance date.

Do not wait for the compliance deadline to discover that the underlying processing inventory cannot answer the question.

6. Who monitors the state-law layer?

Perhaps the most important governance question is ownership.

Is California privacy monitored by the US legal team, the global privacy office, local counsel, compliance, procurement or individual business units?

If everybody assumes somebody else owns it, the gap can survive even inside a sophisticated international privacy programme.

The regulatory stack needs to be viewed horizontally

This is where cross-border governance becomes more difficult than maintaining a collection of transfer documents.

An organisation may have an EU controller, a UK entity, several US subsidiaries and dozens of US vendors. Different data flows may rely on different transfer mechanisms. Individual recipients may then face separate obligations depending on jurisdiction, business activity and use of the information.

The answer is not a larger spreadsheet.

It is an architecture that connects the layers.

For each important data flow, the organisation should be able to identify the data, the entities involved, the transfer mechanism, the processing purpose, relevant vendor dependencies, applicable local obligations and the people responsible for monitoring change.

That is particularly important where US subsidiaries sit within a European-headquartered group. The existence of an internal group transfer mechanism does not remove the need to understand the obligations attaching to the US entity’s own processing.

Likewise, a vendor’s active Data Privacy Framework certification tells you something important about the international transfer.

It does not tell you everything you need to know about the vendor.

Cross-border reviews now need a wider lens

The California development is useful because it exposes a broader weakness in the way international privacy programmes are sometimes designed.

Transfer compliance can become mechanism led.

Teams verify adequacy, maintain SCCs, complete transfer assessments and update contracts. Each activity may be correct, but the resulting architecture can still miss obligations that arise after the transfer because the review was designed to answer a European transfer question rather than understand the complete regulatory lifecycle of the data.

DPG’s cross-border work is built around that wider view.

Our experience supporting multinational organisations with US operations, licensing structures, privacy assessments and managed privacy environments has reinforced the need to connect transfer mechanisms with the processing and regulatory obligations that sit around them.

A cross-border review should therefore test more than whether the data can lawfully cross the Atlantic. It should establish where it goes, what happens to it, which entities and vendors touch it, which regimes those activities trigger and who owns the resulting obligations.

The EU-US Data Privacy Framework and UK Extension remain important parts of that architecture.

California’s DROP regime is a reminder that they are not the whole architecture.

For GCs and DPOs, that is the gap worth looking for now.