California consumers now have a new way to reduce how much personal information is held by data brokers. The state’s Delete Request and Opt-Out Platform, known as DROP, allows eligible California residents to send one deletion request that reaches active registered data brokers. The system was created under California’s Delete Act and is administered by the California Privacy Protection Agency.
This matters because data brokers can collect and sell information about people who may never have directly interacted with them. Depending on the broker, that information may include browsing activity, location data, purchase patterns, health-related details, contact information, and other personal data. For consumers who want more control over their digital footprint, DROP gives them a central place to start.
The timing is especially important in 2026. Californians have been able to submit requests through DROP since January 1, 2026. Beginning August 1, 2026, registered data brokers became responsible for accessing the system and processing deletion requests on a recurring schedule. Therefore, this is a good time for consumers to understand what the tool does, what it does not do, and how to use it carefully.
How California’s DROP Data Deletion System Works
The Delete Act was designed to make data-broker deletion requests easier for California consumers. Before a centralized system, a person might have needed to find individual data brokers and submit separate requests. DROP changes that process by letting a consumer submit a single request through a state-run platform.
What a Data Broker May Know About You
A data broker is generally a business that collects and sells personal information about consumers with whom it does not have a direct relationship. That distinction is important. A company you intentionally use may collect information as part of providing a service. Meanwhile, a data broker may obtain information from other sources and use or sell it without having a normal customer relationship with you.
California’s data-broker registry shows why consumers may care about this issue. Registered brokers can deal with many categories of personal information. The California Privacy Protection Agency notes that data brokers may possess information such as Social Security numbers, precise geolocation, health-related information, and browsing history. Not every broker holds every type of information, but the range can be broad.
If you are already learning about your broader rights as a California consumer, visit our California Consumer Rights section for practical guides on privacy, subscriptions, pricing, scams, and other everyday protections.
One Request Can Reach Many Registered Data Brokers
DROP is intended to reduce the burden of sending the same request again and again. Through the system, a California consumer can direct active registered data brokers to delete non-exempt personal information associated with that consumer. The request is not a promise that every piece of information everywhere on the internet will disappear. Instead, it activates duties that apply to covered data brokers under California law.
The platform is now in an important phase. Data brokers that are subject to the law must access DROP at least once every 45 days and process applicable deletion requests. This recurring requirement matters because businesses must continue returning to the platform and responding to requests rather than treating it as a one-time registry.
Deletion Rights Have Limits and Exceptions
Consumers should not assume that DROP erases every record held by every organization. California privacy law contains exemptions, and the Delete Act focuses on registered data brokers. Some records may be retained when another law allows or requires retention. Certain entities or information may also fall under separate federal or state privacy frameworks.
For that reason, think of DROP as a powerful privacy tool rather than a universal erase button. A consumer may still need to contact a particular business directly, use other California privacy rights, correct inaccurate information, opt out of certain data practices, or take additional steps when a specific record causes a problem.
What Happens After You Submit a DROP Request
Submitting a request is the beginning of the process. It does not necessarily mean all covered information disappears immediately. Under the current system, data brokers must regularly retrieve deletion requests from DROP and process requests that match their records, subject to legal exceptions. The California Privacy Protection Agency also requires brokers to report request status information through the platform.
Consumers should keep realistic expectations. A data broker may need to determine whether the information it holds matches the consumer connected to the request. A request may also be affected by an exemption. Even after information is deleted by covered brokers, a consumer may still see personal details on other websites, public records, social platforms, or services that are not covered by the same deletion request.
Keep a Record of Your Privacy Request
Good recordkeeping is useful whenever you exercise a consumer right. Save confirmation information, note the date you submitted the request, and keep screenshots or other records that show what action you took. If you later believe a covered company failed to honor a valid privacy right, those records can make it easier to explain the problem to the appropriate agency or professional.
This same habit applies to many consumer disputes. Receipts, emails, account notices, screenshots, policy documents, and dates often matter when a disagreement grows. Our Access to Justice section explains how organized records can help when you need to research a complaint process, prepare for a court issue, or decide whether professional guidance is appropriate.
How Californians Can Protect Their Privacy Beyond DROP
DROP can be an important part of a privacy plan. However, consumers should combine it with basic digital-security habits. Data collection does not come only from data brokers. Apps, retailers, social platforms, websites, connected devices, and other services may collect information directly from users. Reducing unnecessary data sharing can limit how much information is available to circulate in the first place.
Use DROP as Part of a Broader Privacy Checkup
Start by reviewing the privacy settings on accounts you use regularly. Remove old accounts you no longer need. Check app permissions for location, contacts, photos, microphone access, and background activity. Use strong, unique passwords and enable multi-factor authentication when it is available. In addition, be cautious about quizzes, promotions, and forms that ask for more information than seems necessary.
You can also review California privacy notices from businesses you interact with. Depending on the business and the law that applies, California consumers may have rights involving access, deletion, correction, or opting out of certain sales or sharing of personal information. DROP adds another layer by focusing on registered data brokers.
Watch for Privacy Scams and Fake Deletion Services
A new privacy tool can also create an opportunity for scammers. Be cautious if a stranger contacts you and claims you must pay a fee, provide a password, share a verification code, install remote-access software, or send sensitive financial information to use a government privacy service. Also, avoid relying on unexpected messages when you are trying to reach an official agency.
For authoritative information, review the California Privacy Protection Agency’s official DROP guidance and data-broker resources. California Privacy Protection Agency DROP information explains how the state system works, which data brokers are covered, and what obligations apply to registered brokers.
It is also smart to review your financial accounts and credit reports for activity you do not recognize. Data deletion cannot undo identity theft that has already happened. Therefore, suspicious transactions, new accounts, or unexpected notices may require separate action. When a privacy issue turns into a financial dispute, fraud problem, or legal concern, use reliable government resources and consider qualified professional advice when needed.
The larger lesson is simple: privacy protection works best when consumers stay active. Use tools like DROP, limit unnecessary sharing, keep account security strong, and save records when you exercise a legal right. California has created a centralized option that can make data-broker deletion easier. Still, consumers benefit from knowing where their information goes and taking practical steps to reduce exposure.
For more California-focused guides, browse the Cali Advocate resource library. We cover consumer rights, insurance, workplace protections, transportation, public safety, and access to justice in plain language designed to help readers understand their options.
