California Delete Act: How the DROP Data Broker Deletion Platform Works

For twenty years the only way to get a data broker to delete you was to find its opt-out form, prove you were you, and repeat that across a few hundred companies. California just built the alternative. Since August 1, 2026, every data broker registered with the state has been legally required to log into a government platform, download a list of people who asked to be deleted, and act on it.

That platform is DROP. Here is what it does, what it does not touch, and whether it is worth fifteen minutes of your time.

What is the California Delete Act?

The California Delete Act is Senate Bill 362, signed into law in October 2023. It did two things. It expanded the state's existing data broker registry, and it ordered the California Privacy Protection Agency, which now operates as CalPrivacy, to build a single mechanism through which one verified consumer request could reach every registered broker at once. That mechanism is the Delete Request and Opt-out Platform, DROP.

The significance is structural. Before the Delete Act, your right to deletion under the CCPA was real but unusable at scale: you had one right and several hundred separate companies to exercise it against, each with its own form and its own idea of acceptable proof. DROP inverts that. You file once, the state holds the list, and the burden of checking it moves onto the brokers.

How does DROP work?

You create a profile at the CalPrivacy DROP site and verify that you are a California resident, either by entering basic personal details or by signing in through Login.gov if you already have an account there. You then choose which identifiers to include in your deletion profile: names, dates of birth, ZIP codes, email addresses, phone numbers, and vehicle identification numbers. CalPrivacy describes this set as the bare minimum needed for brokers to match you against their records.

From there the flow runs on a schedule rather than in real time:

• You submit. One request, to all registered brokers or to a subset you pick. It is free, and there is no paid tier that moves faster.
• Brokers pull the list. Since August 1, 2026, every registered broker must access DROP at least once every 45 days, download the consumer deletion list, and match it against its own records.
• They delete and report. Matched records are deleted, and the broker reports the status back inside DROP.
• It keeps running. This is the part people miss. The request is recurring, not one-shot. A broker that acquires your data next quarter is supposed to catch you on its next 45 day pass.

Children can be enrolled either directly or through parental consent, which matters more than it sounds: minors show up in these databases through household and relative records they never had any part in creating.

Who can use California DROP?

California residents only. Residency verification is built into the sign-up, and there is no equivalent platform in any other state today. If you live in Texas, Oregon, or anywhere else with a data broker registry law, you still have per-broker opt-out rights and no single front door to use them through. Vermont and a handful of other states maintain broker registries, but a registry lists companies; it does not carry your deletion request to them.

Does DROP actually work?

The enforcement teeth are real, which is the best available evidence that it will. A broker that fails to register faces $200 per day in administrative fines, a figure that Senate Bill 361 doubled from $100. Failing to process a deletion request carries $200 per day per undeleted request, plus the agency's investigation costs. Registration itself costs $6,000 a year, and from January 1, 2028 brokers face third-party audits. Brokers also have to publish consumer request metrics annually by July 1.

Adoption on the consumer side has been quieter. As of July 1, 2026, 322,292 Californians had submitted deletion requests through DROP. That is a real number of real people, and it is also well under one percent of the state's population. Most Californians who would want this have never heard of it.

What DROP does not cover

This is where an honest answer matters more than an enthusiastic one, because the gaps are wide enough to drive your home address straight through.

What a DROP request reaches, and what it leaves in place

Covered	Not covered
Data brokers registered with CalPrivacy, described by the agency as more than 500 companies	Brokers that never registered. CalPrivacy has said there are clearly more than 600 of them
Recurring deletion, checked by brokers at least every 45 days	Companies you have a direct relationship with, which are not data brokers by definition
Any identifier you put in your DROP profile	Records tied to a name variant or address you did not include
Deletion at the broker	The Google search result still pointing at the deleted page
Companies meeting the legal definition of a data broker	Entities exempted under federal financial services and credit reporting law
California residents	Everyone in the other 49 states

The unregistered broker problem is the one to sit with. The whole design assumes brokers register. A company that quietly does not register is invisible to DROP, keeps publishing you, and only stops if someone notices and enforces. CalPrivacy has stood up a data broker strike force for exactly this reason, but enforcement runs at the speed of investigations, and your listing is live today.

The exemption for entities regulated under federal financial services and credit reporting law is the other soft edge. Several of the largest holders of American consumer data operate at least partly inside that carve-out, which means the most detailed files about you may be the ones DROP reaches least.

Should you still opt out manually?

Yes, and the reason is coverage rather than distrust. The people-search sites that publish your home address for free to anyone who types your name, the ones that actually cause the harm most people are worried about, are the ones where an unregistered operator or a disputed exemption costs you the most. Filing a DROP request and also filing directly with the sites that come up when you search your own name is not redundant work. It is the same work aimed at two different failure modes.

A practical order of operations for a California resident:

• File the DROP request first. Fifteen minutes, free, recurring, and it does the long tail you would never get to by hand.
• Search your own name. Whatever is on page one is what a recruiter, a landlord, or someone with a grudge will find. Handle those sites individually, starting today.
• Do the groups. Some operators run many sites off one dataset. One request to the PeopleConnect suppression center covers TruthFinder, Intelius, Instant Checkmate, US Search and ZabaSearch, which is the single highest-yield fifteen minutes available outside DROP itself.
• Work the list. Our data broker opt-out list carries the working form for every major US site, with the difficulty and the wait for each.
• Clean the search results. Deleting a record does not clear the cached listing. Removing your personal information from Google is a separate request, filed separately.
• Set a calendar reminder to re-check. Quarterly. Public records keep getting filed, and profiles rebuild from them.

What the Delete Act means if you run a business

The definition that triggers registration is broader than most companies assume: a business that knowingly collects and sells to third parties the personal information of consumers it has no direct relationship with. Plenty of ad tech firms, lead generators, list vendors, and enrichment providers meet that test without ever having described themselves as data brokers. If yours does, you owed a registration by January 31, 2026, a DROP account, a $6,000 annual fee, and a 45 day processing cycle, and the fines accrue daily.

For most companies this lands as one more line in a growing pile of state privacy obligations to map to controls and keep evidence for, alongside the audit requirement that starts in 2028. The Delete Act is worth reading in full rather than delegating to a summary, because the registration trigger, not the deletion mechanics, is where firms are getting caught.

There is a second angle for employers that has nothing to do with compliance. The same people-search listings DROP targets are the raw material for pretext calls against your finance and IT staff, and removing employee data from brokers has become a normal security control for that reason.

The honest verdict

DROP is the most significant thing to happen to consumer data deletion in the United States, and it is still only a partial fix. It converts an impossible task into a fifteen minute one for the brokers that play by the rules, and it does nothing at all about the ones that do not. If you live in California, file it this week. Then go and search your own name, because the sites that show up there are the ones that will still be showing up there in October.

If you would rather not run that loop yourself every quarter, that is the job data removal services exist to do, and we have written honestly about whether they are worth paying for.