California's DROP platform handled 58 million deletion requests in 2024 and brokers denied over 890,000 of them outright. New per-day fines started in August, but Oregon and Texas show the real problem: most brokers aren't even registered.
Twenty US states now have comprehensive privacy laws with incompatible thresholds, opt-out rules, and geolocation-sale bans on three different calendars — here's how SaaS teams are actually coping.
Safari and Firefox killed third-party cookies years ago, and Chrome backed off its own phase-out in 2024. Tracking didn't stop — it moved to canvas, WebGL, and audio signals that consent law wasn't written for.
Erasure law assumes you can delete a record from a database. Once personal data has shaped the weights of a trained model, there is no clean delete button — and that gap is now a live regulatory fight, not a theoretical one.
The UK, EU, and half of US states now mandate identity-linked age checks online. The predictable result is a VPN surge, and regulators are now targeting that too.
Four Chrome and Edge extensions with over 8 million combined users were caught secretly intercepting and selling full ChatGPT, Claude, and Gemini conversations — including medical questions and financial details.
Companies that delete data the moment they stop needing it are shipping faster and losing less in breaches than companies that hoard it — and buyers are starting to notice.
California's Delete Request and Opt-Out Platform went live January 1, and full enforcement teeth kicked in August 1. It's the first real test of whether a single opt-out can work against an industry worth hundreds of billions.
August 1, 2026 was the compliance deadline for California's DROP platform. Brokers now face $200-per-request daily penalties for mishandled deletions — and a new compliance industry has emerged to fill the gap.
As third-party cookies disappear and privacy regulators tighten enforcement, data clean rooms have moved from a niche ad-tech tool to the standard architecture any two companies reach for when they need to combine data without directly exposing it to each other.
GDPR gives EU residents the right to have their data deleted. But once that data has trained a large language model, deletion isn't a database operation anymore — and regulators are done accepting that as an excuse.
Connecticut, California, and eighteen other states have live privacy laws in 2026 that reach into how AI companies source and disclose training data — each with different rules. Here's what's actually enforceable now and how the fragmentation changes compliance math.