Deletion obligations start today for every data broker registered with the California Privacy Protection Agency under the California Delete Act. If you are one of the hundreds of thousands of Californians who have signed up for the Delete Request and Opt-Out Platform since its launch in January, then starting today and every 45 days from now on, every one of the 500+ registered brokers has to delete your information from their systems. If you haven’t already, you can sign up for free now.

What DROP is

DROP is the state’s Delete Request and Opt-out Platform, the first free public tool of its kind, and the deletion mechanism required by the California Delete Act. It allows Californians to securely submit a delete or opt-out request to every registered data broker at once. CalPrivacy, the California Privacy Protection Agency, runs DROP and charges Californians nothing to use it. More than 300,000 Californians have signed up since January. 

Why today is significant

Beginning today, every registered data broker must access DROP at least once every 45 days, retrieve the deletion requests, and delete the personal information of each individual on that list, including any inferences the broker has drawn from that information. A broker has 45 days from receiving your request to complete the deletion, and must direct its service providers and contractors to do the same.

Because the obligation is ongoing, a broker that re-acquires your information after deleting it must delete it again on the following cycle. The Delete Act separately prohibits registered brokers from selling or sharing new personal information about any consumer who has submitted a deletion request.

Its important to note that brokers may decline a request where a legal exemption applies to the information. But, when a broker does decline, it must report that denial to CalPrivacy, disclose the number of requests it denied, and identify the specific provision it relied on.

Where DROP came from

The California Consumer Privacy Act granted Californians the right to request deletion of their personal information, but that right was practically inapplicable to the data broker industry. Consumers have no direct relationship with data brokers, and are rarely aware of which brokers possess their information. Though California created a data broker registry requiring brokers to identify themselves to the state, individuals still faced an enormous burden of submitting and managing separate requests to each of the hundreds of brokers. 

The California Delete Act (SB 362) was enacted in 2023 to close that gap, with the express purpose of giving Californians a single, free, and accessible mechanism to exercise deletion rights against every registered data broker, on a continuing basis. Privacy Rights Clearinghouse co-sponsored SB 362 and led the coalition advocacy behind it, as part of our longstanding work to advance data broker accountability. 

Why data brokers will comply with this law

CalPrivacy has already demonstrated its commitment to data broker enforcement. In November 2025, the agency established a Data Broker Enforcement Strike Force within its Enforcement Division, dedicated to identifying and pursuing brokers that fail to meet their statutory duties. Its actions to date have centered on brokers that never registered with the state: Background Alert agreed to cease operations through 2028, ROR Partners paid $56,600, Accurate Append paid $55,400, and Growbots and UpLead paid roughly $35,000 each.

Those penalties address failure to register, which carries a fine of $200 per day. Failure to delete carries $200 per deletion request, per day. With more than 300,000 requests already submitted through DROP, a broker that holds information on even a fraction of those consumers and declines to process the list accumulates exposure in the millions of dollars daily.

You can sign up now

DROP accepts requests at any time. A request submitted today continues to apply against every registered data broker you choose until you withdraw it.

What if you’re outside California

DROP is available only to verified California residents. Individuals elsewhere can submit deletion requests to data brokers individually, but no other state operates a centralized deletion mechanism and enforcement remains limited. Vermont, Texas, and Oregon maintain data broker registries, which at minimum allow consumers to identify which companies are operating in their market.

California privacy law has repeatedly served as the model across the U.S., which is why we concentrate our advocacy in the state. If you want a comparable right where you live, contact your state and federal lawmakers about the California Delete Act.

You can read more about the Delete Act here and about DROP here.