California's Delete Act and DROP: one request to every registered data broker

Since January 1, California residents have had something no other state offers: a single request, filed once on a state website, that goes to every registered data broker. Before the launch, the agency put the number of brokers it reaches at more than 500. The tool is called DROP, short for Delete Request and Opt-out Platform, and it is the centerpiece of California's Delete Act. If you live in California and have been filing people-search opt-outs one site at a time, it is worth signing up now. It is also worth knowing what it will not do, and that nothing gets deleted through it until August at the earliest.

What follows covers where the law came from, how to use the platform, what brokers must do, and where its edges are. This is general information about a new system that the agency is still refining, so check the official pages before relying on any single step.

Where DROP comes from

The Delete Act is Senate Bill 362, signed in October 2023 (Chapter 709, Statutes of 2023). It did two big things.

First, it moved California's data broker registry. The state Department of Justice had run the registry since 2020; from January 1, 2024, it belongs to the California Privacy Protection Agency. Every business that meets the definition of a data broker must register each year by January 31, and the public registry shows each one's contact details and how to exercise your rights with it. A broker that fails to register faces an administrative fine of 200 dollars for each day, plus costs, and the agency has been bringing those cases: on January 8 it announced two more decisions against brokers that had not registered.

Second, it required the agency to build what the statute calls an accessible deletion mechanism by January 1, 2026 (Civil Code section 1798.99.86). DROP is that mechanism. The agency adopted the detailed rules for it in September 2025, and they were approved and filed in November.

A word on names. The agency's formal name is still the California Privacy Protection Agency, and older documents call it the CPPA. Since November 2025 it has presented itself to the public as CalPrivacy. Same agency, same powers.

Who counts as a data broker matters, because DROP reaches brokers and nobody else. Under the Delete Act, a data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom it does not have a direct relationship. The DROP regulations define a direct relationship as having intentionally interacted with the business, for example to buy or use its products, within the past three years. So a people-search site that built a profile of you from records you never gave it is a broker as far as you are concerned; the store where you have a loyalty card is not.

The dates that matter

The gap between January and August is deliberate: people sign up first, brokers start processing later. A broker must pick up the request list at least once every 45 days and act on what it receives within 45 days, so the first deletions could land any time from August into the fall.

Using DROP, step by step

1. Go to the official site. DROP lives at privacy.ca.gov/drop. The statute says consumers cannot be charged for it, so a site that asks for payment to "file your DROP request" is not the state.
2. Verify that you live in California. Only residents can submit a request. There are two ways to verify: the California Identity Gateway, which checks details you enter, or Login.gov, the federal sign-in service. If the system classifies you as a non-resident, the regulations let you ask for a review within 10 calendar days.
3. Add the details brokers will match on. The regulations let you add your date of birth, email addresses, phone numbers and pseudonymous identifiers such as a mobile advertising ID, and the platform also takes a ZIP code and accepts extras like a vehicle identification number. Brokers match on an email address, a phone number, or the combination of name, date of birth and ZIP code, so an old email address or a former ZIP code can catch records that your current details would miss.
4. Submit, and keep the confirmation. Your details go to brokers in hashed form, a one-way scrambled version, and each broker compares it with hashed versions of its own records.
5. Leave it alone for a while. You can amend or cancel a request only after 45 days have passed since you submitted it.
6. If you want help, you can use an authorized agent, but only after verifying your residency yourself, and you must disclose the agent's name and email address in your DROP account.

One more rule protects you from a predictable scam: the regulations bar brokers from contacting you to verify a request you made through DROP. A call or email from a "data broker" asking you to confirm your DROP details deserves suspicion.

What a broker must do once it picks up your request

From August 1, 2026, a registered broker must:

• check DROP at least once every 45 days and, within 45 days of receiving a request, delete all personal information about the matched person, including inferences drawn from data it collected from other sources;
• tell its service providers and contractors to delete that information too;
• if it cannot verify a request, for example because an identifier matches several people, treat it as an opt-out of sale and sharing instead;
• keep deleting at least once every 45 days and not sell or share new personal information about you, unless an exemption applies;
• keep the request on file even when it finds no match, and check newly collected records against it before selling them.

Brokers report one of four results back to the agency: record deleted, record opted out of sale, record exempted, or record not found. A "not found" is not the end of the story, because of that last duty.

The repeating 45-day cycle is the part that one-at-a-time opt-outs have never had. As Maren explained in why people-search listings come back after you opt out, a listing often returns when a site buys fresh data. Under DROP, a registered broker has to filter that fresh data against your request before it can sell it.

The enforcement terms are serious on paper. A broker that fails to delete faces a fine of 200 dollars per deletion request for each day it fails, and from January 1, 2028, every broker must undergo an independent audit of its compliance every three years.

What DROP will not do

This is the part people miss.

• It reaches registered data brokers only. A broker that ignores the registration requirement will not pick up your request, though it is breaking the law. Companies you do business with directly are not brokers as far as you are concerned; to ask them to delete data, use your rights under the California Consumer Privacy Act, one company at a time.
• It does not cover information a broker collected from you directly, as a first party.
• It does not cover data that California's privacy law exempts, such as information governed by the Fair Credit Reporting Act (credit reports and many background checks), the Gramm-Leach-Bliley Act (financial institutions) or HIPAA (health information). For how the FCRA side works, see where that line falls for people-search sites.
• It does not change public records. Information lawfully made available from government records counts as publicly available and falls outside the state law's definition of personal information. The deed at the county recorder stays where it is, and a broker may keep details that come straight from such records.
• It does not remove search engine results, or pages on sites that are not data brokers.
• It does not help people who live outside California, and it does nothing for anyone until August.

What to do between now and August

If a listing is causing you a problem today, a DROP request will not fix it before August. Keep using individual opt-outs for the sites that matter most to you; the opt-out guide has the routes for the big people-search sites. Paid services such as DeleteMe file opt-out requests with people-search sites on your behalf. Whether that is worth it depends on how many sites list you, and on how many of them will be covered by DROP once processing starts.

If someone is trying to find you and you fear for your safety, do not wait for August. Talk to a domestic violence or victim advocate about Safe at Home, California's address confidentiality program run by the Secretary of State.

If a registered broker ignores your request once its deadline has passed, the complaint goes to CalPrivacy. Whether a particular use of your data falls under one of the exemptions is a question for a privacy lawyer, not a web form.

A short checklist for this week

• Sign up at privacy.ca.gov/drop if you live in California, and keep your confirmation.
• Add the older email addresses, phone numbers and ZIP codes that brokers are likely to hold.
• Put a reminder in your calendar for early fall to check your request status.
• Keep your manual opt-outs going for any listing that worries you now, and track them on the opt-out checklist.