California is rolling out a new tool designed to make it easier for residents to limit how data brokers collect, store, and sell their personal information.
Although Californians have had the legal right since 2020 to ask companies to stop collecting and selling their data, exercising that right has often required a time-consuming process of opting out with each company. The Delete Act, passed in 2023, aimed to streamline that process by allowing residents to submit a single request that would apply to more than 500 registered data brokers.
That system is now live. The Delete Requests and Opt-Out Platform (DROP) enables California residents to submit a single deletion request, which is sent to all current and future data brokers registered with the state, once users verify their residency.
However, the process will not result in immediate deletion. Data brokers are expected to begin processing requests in August 2026, after which they will have up to 90 days to comply and report back. If a broker is unable to locate or delete a user’s data, residents will have the option to submit additional information to help identify their records.
The law applies specifically to data brokers—companies that buy or sell personal information. Businesses may still retain first-party data collected directly from users. The types of information subject to deletion requests can include Social Security numbers, browsing histories, email addresses, phone numbers, and other personal details.
Specific data is exempt from deletion. Information sourced from public records, such as vehicle registrations or voter rolls, is excluded. Other categories of data, including sensitive medical information, may already be protected under separate regulations, such as HIPAA.
According to the California Privacy Protection Agency, the new platform is intended to give residents greater control over their personal information. The agency also said the tool could help reduce unwanted texts, phone calls, and emails, while lowering the risk of identity theft, fraud, AI-based impersonation, and data breaches.
Data brokers that fail to register with the state or do not comply with valid deletion requests face penalties of $200 per day, in addition to enforcement costs, the agency said.
