California's Delete Act & DROP, Explained: One Request to Delete Your Data From 600+ Brokers
Updated 6 September 2026. This guide was first written before broker obligations began. The runway is over: deletion processing became mandatory on 1 August 2026, and because registered brokers must access the platform at least every 45 days, the first mandatory cycle closes in mid-September 2026. The sections below have been brought up to date.
The short version: the California Delete Act (SB 362, signed October 2023) required the state to build a single place where any California resident can tell every registered data broker at once to delete their personal information. That platform — DROP, the Delete Request and Opt-out Platform — went live at privacy.ca.gov/drop on January 1, 2026. It is free and covers more than 600 registered data brokers. Since August 1, 2026, every registered broker must retrieve DROP requests at least every 45 days, act on deletions, and keep your data suppressed going forward. More than 300,000 Californians had signed up within the first five months (CalPrivacy, June 2026).
If you are a California resident, submitting a DROP request is the highest-leverage privacy action available to you in 2026. Here is how it works, what it covers, and where it stops.
What the Delete Act actually requires
The Delete Act (SB 362, Chapter 709, Statutes of 2023) built on California's 2019 data broker registration law and added teeth:
- Annual registration: data brokers must register with the California Privacy Protection Agency (CalPrivacy) every year and disclose what categories of information they collect. The registry hit a record high of 600+ brokers in 2026 (privacy.ca.gov).
- A one-stop deletion mechanism: CalPrivacy had to build a free platform where a consumer submits one verified request that reaches all registered brokers. That is DROP.
- Ongoing suppression: once you submit a deletion request, brokers must not only delete what they hold but also delete information they acquire about you in the future — a structural fix for the industry's relist-after-removal habit.
- Audits and penalties: brokers face compliance obligations and administrative fines for failing to register or failing to process deletion requests. Separately, the Agency has proposed audit regulations — see the proposed DROP audit rules, which are not in force and whose comment window has not yet opened.
The DROP timeline
| Date | What happens |
|---|---|
| October 2023 | Delete Act (SB 362) signed into law |
| 2024–2025 | CalPrivacy administers broker registry, builds DROP |
| January 1, 2026 | DROP opens — Californians can submit deletion requests |
| June 2026 | 300,000+ consumers registered; 600+ brokers on the registry |
| August 1, 2026 | Broker processing became mandatory — access DROP at least every 45 days and act on deletion requests |
| Mid-September 2026 | Outer edge of the first mandatory 45-day access window |
| Ongoing | Brokers re-check DROP at least every 45 days and maintain suppression |
| 7 August 2026 | CPPA board voted proposed audit regulations out to formal rulemaking (not in force) |
Requests submitted at any point since January 1 are queued — you did not need to wait for August 1, and there is no advantage to waiting now. And where a broker cannot verify a request, it must at minimum process it as an opt-out of the sale or sharing of your personal information.
How to submit a DROP request
- Go to privacy.ca.gov/drop (the official state site — DROP is free; anyone charging for "DROP submission" is a middleman).
- Verify that you are a California resident.
- Create your profile with the identifying details you want deleted (name, addresses, emails, phone numbers).
- Submit.
- Return any time to check status or update your information.
⭐ The step most people skip: widen your profile
CalPrivacy hashes your identifiers before brokers retrieve them, and brokers match those hashed values against their own records. That is a good privacy design — no broker receives a clean roster of verified Californians — but it means matching is where the outcome is decided. If a broker holds you under a former surname, an old address, a misspelling or an email you no longer use, the hashes do not agree, nothing happens, and no error is raised.
So go back into DROP and add every former name, prior address, old phone number and dead email address you can recall. The identifiers you supply are the entire surface area of your request. This is the single highest-leverage thing most filers have left undone — more so than anything else in this guide.
Why you have not heard anything back
Because the Delete Act's reporting runs from the broker to the regulator, not from the broker to you. Brokers report their processing status to CalPrivacy. Nothing requires a broker to write to the consumer, so there is no confirmation email, no per-broker breakdown, and no list of who found you. If you have been waiting for one, that is why it has not arrived. More on what the first cycle actually involves.
What DROP does not cover
DROP is the strongest tool of its kind in the country, and it is still not the whole job:
- Only registered California data brokers. And the statutory definition of "data broker" reaches only a business selling the information of a consumer with whom it does not have a direct relationship — so every company you have actually dealt with is outside it, along with entities covered by the FCRA, the Gramm-Leach-Bliley Act, the Insurance Information and Privacy Protection Act, and the health-information exemption. That includes the credit bureaus, to the extent they are covered by the FCRA. The definitions, and where they part company with what people expect. For businesses you dealt with directly, use a direct CCPA deletion request.
- Only California residents. Residents of the other states with privacy laws have deletion rights but no central platform — see which rights you actually have in your state.
- Unregistered and offshore sites. People-search sites that ignore the registration requirement are, by definition, not retrieving DROP requests. In the meantime they need direct opt-outs.
- Data already in breach dumps. Deletion requests reach brokers' databases, not stolen copies circulating in breach corpora.
- Government records. Public records held by agencies are a separate rail entirely — that is FOIA territory.
Why this matters beyond California
The Delete Act is the template other states are watching. Broker registries already exist in Texas, Oregon, and Vermont, and several states are developing their own. The combination that DROP pioneered — mandatory registration, a central request platform, and forward-looking suppression — is the first regulatory design that actually matches how the data broker industry re-lists people. Expect copies.
Frequently asked questions
Is DROP free?
Yes. DROP is a free state service run by CalPrivacy at privacy.ca.gov. There is no premium tier and no fee. Any third party charging money to "file your DROP request" is adding cost, not capability.
When did data brokers have to start acting on DROP requests?
Processing obligations began on 1 August 2026. From that date registered brokers must access DROP at least every 45 days and act on deletion requests. Forty-five days from 1 August places the outer edge of the first mandatory access window in mid-September 2026. Requests submitted since the January 1, 2026 launch were queued and enter that processing.
Will a broker tell me it deleted my information?
There is no requirement that it tell you. Processing status is reported by the broker to CalPrivacy, not to the consumer.
Does DROP delete my data permanently?
For registered brokers, the Delete Act requires ongoing suppression: after processing your request, a broker must also delete personal information it acquires about you going forward. That is stronger than a one-time opt-out. It does mean the broker retains enough to recognise you — it cannot suppress a person it has no record of — and it does not reach unregistered sites, non-broker businesses, or already-leaked copies of your data.
Does DROP reach the credit bureaus?
To the extent an entity is covered by the federal Fair Credit Reporting Act, it is excluded from the Delete Act's "data broker" definition. The FCRA provides its own disclosure and dispute rights, which are separate from and older than the Delete Act.
Do I need DROP if I already use a removal service?
They cover different ground and stack well. DROP is the legal hammer for the 600+ registered California brokers. A removal or monitoring service covers unregistered people-search sites, breach exposure, non-California brokers, and the work of finding out where you actually appear. If you are a Californian, do both: DROP costs nothing.
I'm not in California. Can I use DROP?
No — eligibility requires California residency. Check our state privacy law guide for the deletion rights your state provides, and use brokers' own opt-out processes, which are open to everyone.
Sirveil complements DROP. Our service determines whether a named individual's information is publicly indexed at a named website at a given moment, and reports that observation as INDEXED, NOT INDEXED, or INDETERMINATE. We do not verify that anyone complied with anything: index presence is not proof that a deletion request was ignored, and index absence is not proof that data was deleted. Sirveil is on Google Play and the App Store.
Sources cited: privacy.ca.gov/drop and CalPrivacy DROP announcements (December 2025, June 2026); SB 362 (Chapter 709, Statutes of 2023); Cal. Civ. Code §§ 1798.99.80 and 1798.99.86. Last verified 6 September 2026. This article is general information, not legal advice — Sirveil writes as a commercial party with a disclosed interest, not as counsel.