California Delete Act: How the DROP Delete Request and Opt-Out Platform Works
The short answer
The California Delete Act (Senate Bill 362) created DROP, the Delete Request and Opt-out Platform, which lets a California resident send a single free deletion request to every data broker registered with the state. Consumers have been able to file since January 1, 2026, and since August 1, 2026 registered brokers must access DROP and process those requests at least once every 45 days. As of July 1, 2026, 322,292 Californians had filed. DROP reaches registered brokers only, so it does not touch the several hundred that never registered.
Exposure scan
Live
Scanning
Searching the public web
This runs a real search, so it can take up to about 45 seconds. Nothing is stored.
in your top results public results for
No broker listing ranked today. That is not the same as being private: search engines demote people-search pages, and the brokers still publish to anyone who searches them directly.
Reconstructed best-effort from live public search listings.
The live top results for your name, reconstructed from public search. The "data broker" badge is matched against our own directory of 45 brokers.
These brokers index US adults and each opt-out link is real and free. We have not checked each one for your name, and we will not pretend otherwise. That is what the full service does.
Live search unavailable
The live search did not come back this time, so we will not guess. Here is your removal plan instead, from our directory of 45 real data brokers.
Scan limit reached
You have used your scans for now. The demo runs on a shared key, so we cap it. The real service re-scans for you every month without a cap.
For twenty years the only way to get a data broker to delete you was to find its opt-out form, prove you were you, and repeat that across a few hundred companies. California just built the alternative. Since August 1, 2026, every data broker registered with the state has been legally required to log into a government platform, download a list of people who asked to be deleted, and act on it.
That platform is DROP. Here is what it does, what it does not touch, and whether it is worth fifteen minutes of your time.
What is the California Delete Act?
The California Delete Act is Senate Bill 362, signed into law in October 2023. It did two things. It expanded the state's existing data broker registry, and it ordered the California Privacy Protection Agency, which now operates as CalPrivacy, to build a single mechanism through which one verified consumer request could reach every registered broker at once. That mechanism is the Delete Request and Opt-out Platform, DROP.
The significance is structural. Before the Delete Act, your right to deletion under the CCPA was real but unusable at scale: you had one right and several hundred separate companies to exercise it against, each with its own form and its own idea of acceptable proof. DROP inverts that. You file once, the state holds the list, and the burden of checking it moves onto the brokers.
How does DROP work?
You create a profile at the CalPrivacy DROP site and verify that you are a California resident, either by entering basic personal details or by signing in through Login.gov if you already have an account there. You then choose which identifiers to include in your deletion profile: names, dates of birth, ZIP codes, email addresses, phone numbers, and vehicle identification numbers. CalPrivacy describes this set as the bare minimum needed for brokers to match you against their records.
From there the flow runs on a schedule rather than in real time:
- You submit. One request, to all registered brokers or to a subset you pick. It is free, and there is no paid tier that moves faster.
- Brokers pull the list. Since August 1, 2026, every registered broker must access DROP at least once every 45 days, download the consumer deletion list, and match it against its own records.
- They delete and report. Matched records are deleted, and the broker reports the status back inside DROP.
- It keeps running. This is the part people miss. The request is recurring, not one-shot. A broker that acquires your data next quarter is supposed to catch you on its next 45 day pass.
Children can be enrolled either directly or through parental consent, which matters more than it sounds: minors show up in these databases through household and relative records they never had any part in creating.
Who can use California DROP?
California residents only. Residency verification is built into the sign-up, and there is no equivalent platform in any other state today. If you live in Texas, Oregon, or anywhere else with a data broker registry law, you still have per-broker opt-out rights and no single front door to use them through. Vermont and a handful of other states maintain broker registries, but a registry lists companies; it does not carry your deletion request to them.
Does DROP actually work?
The enforcement teeth are real, which is the best available evidence that it will. A broker that fails to register faces $200 per day in administrative fines, a figure that Senate Bill 361 doubled from $100. Failing to process a deletion request carries $200 per day per undeleted request, plus the agency's investigation costs. Registration itself costs $6,000 a year, and from January 1, 2028 brokers face third-party audits. Brokers also have to publish consumer request metrics annually by July 1.
Adoption on the consumer side has been quieter. As of July 1, 2026, 322,292 Californians had submitted deletion requests through DROP. That is a real number of real people, and it is also well under one percent of the state's population. Most Californians who would want this have never heard of it.
What DROP does not cover
This is where an honest answer matters more than an enthusiastic one, because the gaps are wide enough to drive your home address straight through.
| Covered | Not covered |
|---|---|
| Data brokers registered with CalPrivacy, described by the agency as more than 500 companies | Brokers that never registered. CalPrivacy has said there are clearly more than 600 of them |
| Recurring deletion, checked by brokers at least every 45 days | Companies you have a direct relationship with, which are not data brokers by definition |
| Any identifier you put in your DROP profile | Records tied to a name variant or address you did not include |
| Deletion at the broker | The Google search result still pointing at the deleted page |
| Companies meeting the legal definition of a data broker | Entities exempted under federal financial services and credit reporting law |
| California residents | Everyone in the other 49 states |
The unregistered broker problem is the one to sit with. The whole design assumes brokers register. A company that quietly does not register is invisible to DROP, keeps publishing you, and only stops if someone notices and enforces. CalPrivacy has stood up a data broker strike force for exactly this reason, but enforcement runs at the speed of investigations, and your listing is live today.
The exemption for entities regulated under federal financial services and credit reporting law is the other soft edge. Several of the largest holders of American consumer data operate at least partly inside that carve-out, which means the most detailed files about you may be the ones DROP reaches least.
Should you still opt out manually?
Yes, and the reason is coverage rather than distrust. The people-search sites that publish your home address for free to anyone who types your name, the ones that actually cause the harm most people are worried about, are the ones where an unregistered operator or a disputed exemption costs you the most. Filing a DROP request and also filing directly with the sites that come up when you search your own name is not redundant work. It is the same work aimed at two different failure modes.
A practical order of operations for a California resident:
- File the DROP request first. Fifteen minutes, free, recurring, and it does the long tail you would never get to by hand.
- Search your own name. Whatever is on page one is what a recruiter, a landlord, or someone with a grudge will find. Handle those sites individually, starting today.
- Do the groups. Some operators run many sites off one dataset. One request to the PeopleConnect suppression center covers TruthFinder, Intelius, Instant Checkmate, US Search and ZabaSearch, which is the single highest-yield fifteen minutes available outside DROP itself.
- Work the list. Our data broker opt-out list carries the working form for every major US site, with the difficulty and the wait for each.
- Clean the search results. Deleting a record does not clear the cached listing. Removing your personal information from Google is a separate request, filed separately.
- Set a calendar reminder to re-check. Quarterly. Public records keep getting filed, and profiles rebuild from them.
What the Delete Act means if you run a business
The definition that triggers registration is broader than most companies assume: a business that knowingly collects and sells to third parties the personal information of consumers it has no direct relationship with. Plenty of ad tech firms, lead generators, list vendors, and enrichment providers meet that test without ever having described themselves as data brokers. If yours does, you owed a registration by January 31, 2026, a DROP account, a $6,000 annual fee, and a 45 day processing cycle, and the fines accrue daily.
For most companies this lands as one more line in a growing pile of state privacy obligations to map to controls and keep evidence for, alongside the audit requirement that starts in 2028. The Delete Act is worth reading in full rather than delegating to a summary, because the registration trigger, not the deletion mechanics, is where firms are getting caught.
There is a second angle for employers that has nothing to do with compliance. The same people-search listings DROP targets are the raw material for pretext calls against your finance and IT staff, and removing employee data from brokers has become a normal security control for that reason. See employee data removal for what a managed rollout covers.
The honest verdict
DROP is the most significant thing to happen to consumer data deletion in the United States, and it is still only a partial fix. It converts an impossible task into a fifteen minute one for the brokers that play by the rules, and it does nothing at all about the ones that do not. If you live in California, file it this week. Then go and search your own name, because the sites that show up there are the ones that will still be showing up there in October.
If you would rather not run that loop yourself every quarter, that is the job data removal services exist to do, and we have written honestly about whether they are worth paying for.
Written by
The Dataremoval team, at Dataremoval. We run an AI data removal service, which is why we spend our days reading data broker opt-out forms. Corrections to app@dataremoval.ai.
Keep reading
Experian Personal Privacy Scan Review: Does Experian Privacy Scan Work, Is It Legit, and What Removal Costs
Experian's privacy scan is free once, but getting listings removed needs an IdentityWorks membership at $24.99 a month. What that buys, what Experian does not publish, and what the same money buys from dedicated removal services.
Incogni Unlimited vs Standard: Is Incogni Unlimited Worth $84 More, and What Incogni Protect Adds
Incogni Unlimited costs $84 a year more than Standard and covers the same 420+ brokers. The difference is custom removals from sites you name. What they reach, what the terms say they will not, and who the new US-only Protect plan is for.
NordVPN Incogni Bundle Cost: Which Incogni Plan You Get, and When Buying Incogni Directly Is Cheaper
Nord bundles Incogni into NordVPN and Coveron plans, but always the Standard tier, which works a fixed list of 420+ brokers and will not take down a site you name. What each bundle includes, what Incogni costs on its own, and when the bundle is the wrong buy.
LifeLock Data Broker Removal: What It Costs on Core, Advanced and Total, and What It Actually Removes
LifeLock now includes Automatic Data Broker Removal on Core, Advanced and Total, from $124.99 a year. Norton's own support document calls it a lighter version that covers "a smaller set" of brokers, and neither brand publishes how many. Prices, what it skips, and what to buy instead.
Bitdefender Digital Identity Protection Review: What It Costs, and Why It Does Not Remove Your Data
Bitdefender Digital Identity Protection is $39.99 for the first year and renews at $79.99, and none of its five features files a removal request. Bitdefender's own FAQ says you act to remove the data it finds. What it is good at, and what to buy instead if you want takedowns.
McAfee Personal Data Cleanup Review: What It Costs and Which Plans Actually Remove Your Data
McAfee's own plan comparison says Personal Data Cleanup is "Scans only" on the tier it recommends most. Removal starts one plan higher, at $89.99 for the first year and $199.99 on renewal, and McAfee publishes neither a broker count nor a list.
Reputation Defender Cost in 2026: What ReputationDefender Charges, and Why the Price Is Not Published
ReputationDefender does not publish a price on any page of its own website, and the estimates in circulation span three orders of magnitude. Here is what we could verify instead: who owns it, what an independent test measured, and what the services that do print their prices charge.
EasyOptOuts vs Incogni vs Privacy Bee: Pricing and Coverage Compared
One of these costs $19.99 a year, one costs $95.88, and one costs $96.00 for less coverage than the $19.99 option advertises. The gap is not quality. It is how often each one rescans, who files the removals, and how much of the advertised roster your plan actually reaches.
OneRep vs Incogni vs DeleteMe: Pricing, Coverage and Cost per Person Compared
These three land on every shortlist and the roundups almost never put the rate cards next to each other. Do that and the answer is simpler than the star ratings suggest, because one of the three headline coverage numbers only applies to the tiers most buyers skip.
Privacy Bee vs Kanary: Reviews, Pricing, and Which Is Worth Paying For
These two are listed together in every roundup and are not competing for the same buyer. One claims more data brokers than anyone in the category for less than DeleteMe charges; the other sells the most expensive individual seat in it, and has a reason.
Optery vs DeleteMe Pricing: Which Data Removal Service Is Cheaper, Seat by Seat
This is the only matchup in the category where both vendors put a human privacy agent on the account, which makes it the one comparison where you are pricing like against like. Twenty dollars separates them for one person, and four hundred for a family.
Optery vs Incogni Pricing: Which Data Removal Service Is Cheaper, Tier by Tier
Optery sells per person and Incogni sells per household, which flips the answer depending on how many people you cover. Every tier of both, on both billing terms, with the per-seat math done.
Is OneRep Legit? A OneRep Review of the Pricing, the Owner and the Mozilla Split
OneRep works, and its family plan is the cheapest per seat in the category. The reason people ask this question is the ownership, which its own chief executive has confirmed, and the partnership Mozilla spent twenty months unwinding.
Spam Text Blocker App Pricing: What a Text Blocker for iPhone or an Android Message Blocker Costs
Two of the best text blockers are already on your phone and cost nothing. Of the products that charge, one publishes its prices and one refuses to, and two of the three carriers do not filter texts at all.
Scam Likely and Spam Risk Calls: T-Mobile Scam Shield App Pricing and How to Stop Scam Likely Calls
Scam Likely is T-Mobile's label, Spam Risk is AT&T's and Potential Spam is Verizon's. Here is what each one costs to act on, the free code that blocks them on T-Mobile, and why a label is not a block.
Call Blocker App for Android: Spam Call Blocker and Block Spam Calls App Pricing
Three of the four call blockers worth having on an Android phone cost nothing, and two of them are already installed. Here is what each one blocks, what the paid tiers charge, and the thing none of them fix.
Spam Call Blocker for iPhone: RoboKiller vs Nomorobo Pricing, and the Free Carrier Apps
One of these two vendors publishes its prices on its own website and the other does not. Here is what each spam blocker costs, what the free layers already do, and the thing none of them fix.
I Keep Getting Spam Calls All of a Sudden: Why You Keep Getting Spam Phone Calls, and How to Stop Them
A sudden flood of spam calls is almost never random. Six things cause it, five of them are traceable, and the Do Not Call list only addresses one.
DMAchoice: Junk Mail Opt Out, What It Costs, and Is DMAchoice.org Legit
The mail preference service the advertising industry runs on itself. What the $8 actually buys, the four categories, and the mail it is structurally unable to stop.
What Is LexisNexis? Your LexisNexis Consumer Report and CLUE Report Explained
Most people meet LexisNexis in a denial letter. It holds a Fair Credit Reporting Act file on you that no website publishes, and you can read it free once a year.
Google Removal Request: How to Delete Google Search Results
Google runs five separate removal paths, and picking the wrong one is why most requests get denied. Here is which form handles which problem, and what none of them can do.
What Is a Data Broker? What They Sell, Who Buys It, and Are Data Brokers Legal
The companies with the most detailed file on you are the ones you have never contacted. Here is what that industry actually is, what California now forces it to disclose, and what any of it means for you.
How to Remove Your Address From the Internet and Public Records
Your home address sits in two places: the county record that created it and the dozens of commercial copies. Only one of those is removable, and it is not the one people start with.
How to Remove Your Name From Google Search Results
You cannot delete a name from Google. You can delete most of the pages that make it worth searching, and the order you do it in decides whether it stays gone.
How to Remove Your Information From the Internet
The complete 2026 method: what is actually removable, the order to do it in, the brokers that matter most, and the parts nobody can delete for you.
Data Brokers Opt Out: The Complete Opt-Out List
Every major data broker, what it publishes about you, how hard the opt-out is, how long it takes, and a direct link to the real form.
How to Remove Your Information From the Dark Web (Email, Phone, SSN)
The honest answer: you almost certainly cannot delete it. Here is what you can do instead, and why the services promising deletion are selling you monitoring.
Data Broker Removal for Businesses: Employee Data Removal as a Security Control
Why security teams are buying data removal for staff, what it costs per seat, which roles to cover first, and how to tell a real enterprise offering from a repackaged consumer plan.
DeleteMe vs Incogni: An Honest 2026 Comparison
A side-by-side of the two best-known data removal services: real pricing, broker coverage, verification, speed, and which one fits which person.
Are Data Removal Services Worth It?
When paying for data removal actually pays off, when to do it yourself for free, and the one feature that decides whether the subscription is worth the money.
How to Remove Your Phone Number From the Internet
Where your number leaks from, the free order to clean it up in, the caller-ID apps most guides forget, and the calls you will still get afterward.
How Much Does Data Removal Cost?
Real 2026 numbers for DeleteMe, Incogni, and Optery, what family plans add, the free DIY route, and the single line item that actually justifies the yearly fee.