California's Delete Act and DROP: One Request to Every Registered Data Broker
If you live in California, you can use the state's Delete Request and Opt-out Platform (DROP) to send a single deletion request to every registered data broker at once. It's free and run by the California Privacy Protection Agency (CalPrivacy). Since August 1, 2026, registered data brokers must check DROP at least once every 45 days and delete matching records unless an exemption applies.
Below are the questions we hear most, with answers drawn from the agency's own guidance. This is general information, not legal advice.
What is the Delete Act?
The Delete Act is Senate Bill 362, passed in 2023. It built on the California Consumer Privacy Act (CCPA). Before it, you had to find each data broker and file a separate request with each one. The Delete Act required the state to build one central deletion system, and it requires data brokers to register every year, process DROP requests, report what they collect and share, and undergo audits.
Who counts as a data broker?
Generally, a business that collects and sells personal information about people it doesn't have a direct relationship with. That's the people-search sites, marketing list sellers and data aggregators you've never done business with. Registered brokers appear in the state's Data Broker Registry; DROP reaches more than 600 of them.
The companies you do business with directly, such as your bank, your phone carrier or the stores where you have accounts, generally aren't covered by a DROP request. For those, you use your regular CCPA rights and submit requests to each company.
Who can use DROP?
California residents. You verify residency through the California Identity Gateway, either by entering your information directly or by using an existing Login.gov account. According to CalPrivacy, DROP doesn't retain the information used for that verification. A parent or guardian can also submit on behalf of someone else, such as a child.
If you don't live in California, you can't use DROP. You'll need to opt out broker by broker. Our personal information removal page explains that process.
How do I submit a request?
Go to consumer.drop.privacy.ca.gov, verify your residency, and enter the details you want brokers to match against. DROP accepts names, email addresses, phone numbers, date of birth, ZIP codes, mobile advertising IDs (MAIDs), connected TV IDs and vehicle identification numbers (VINs).
You choose how much to share. CalPrivacy's own guidance is that the more identifiers you add, the more likely brokers are to find and delete your records. A few practical suggestions:
- Add every email address and phone number you've used in the last several years, not just your current ones. Brokers match on old data.
- Include name variations, such as a maiden name or a commonly used nickname.
- Add ZIP codes for past addresses as well as your current one.
- If you're comfortable doing it, add your phone's advertising ID. CalPrivacy has a guide to mobile advertising IDs explaining what they are and how to find yours.
What happens after I submit?
Registered brokers had to start pulling requests from DROP on August 1, 2026, and must check at least once every 45 days after that. When a broker finds a match, it must delete the non-exempt personal information it holds about you, including inferences drawn from it, and report the request's status back through DROP within 45 days of retrieving it.
CalPrivacy says updates can take up to 90 days to appear. You can check progress at the DROP status page. Your request stays in the system, so brokers are expected to keep deleting matching records they collect later, not just what they held on the day you filed.
What won't DROP remove?
- Exempt information. Brokers delete personal information as California law defines it. Information outside that definition, publicly available government records being the main example, and data covered by certain other laws can be kept.
- Unregistered brokers. DROP only reaches businesses on the state registry. A broker that fails to register is breaking the law, but it won't get your request.
- First-party data. Companies you deal with directly aren't covered, as noted above.
- Search results and news. DROP doesn't touch Google results, news articles, court records, reviews or social media posts. Those need separate processes. See our guide to removing content from Google Search.
- Sites outside the broker model. A forum, a blog or a mugshot site that republished your information isn't necessarily a registered data broker.
Will it affect anything I use?
Possibly a little. CalPrivacy notes that deletion may affect some online experiences, such as how targeted the ads you see are. It doesn't close your accounts with companies you do business with.
Is it still worth opting out of people-search sites manually?
For most Californians, file with DROP first. It's the single highest-leverage step available and costs nothing. Then spot-check the major people-search sites after the 90-day window. If a listing is still live, look the site up in the Data Broker Registry. If it's registered, it should be processing your DROP request, and you can also file a direct opt-out. If it isn't registered, a direct opt-out is your only route. CalPrivacy also takes complaints about brokers that don't comply.
When outside help makes sense
DROP handles the broker layer well. It doesn't handle news coverage, court records, reviews or harassment. If those are what's actually hurting you, that's where professional help tends to pay off. Start with DROP either way.
Want this handled for you? See our data broker and personal info removal service.
