California Delete Act DROP rules changed how much control state residents have over companies that buy and sell their personal information without ever meeting them. Picture getting a call from a background-check company you’ve never heard of, asking to verify a loan you never applied for.
Under a 2023 California law, one form can now cancel your file with every broker registered in the state at once. Here’s how the process actually works, and how it fits into the wider push to opt out of data brokers.
The Short Version
- The California Delete Act (Senate Bill 362) created DROP so consumers submit one deletion request instead of contacting hundreds of data brokers separately.
- Registered data brokers must log into DROP and process pending deletion requests at least once every 45 days, starting August 1, 2026.
- Data brokers operating in California in 2025, or newly operating in 2026, also had to complete annual registration with the California Privacy Protection Agency (CPPA) the state agency that built and runs DROP.
- Using DROP costs consumers nothing. The registration and access fees fall entirely on the data broker companies.
What California’s Delete Act and DROP Tool Actually Say Under State Law
In California, the Delete Act formally Senate Bill 362, Chapter 709 of the Statutes of 2023 expanded the state’s existing privacy law, the California Consumer Privacy Act (CCPA) the law that first gave California residents rights to access, delete, and limit the sale of their personal data.
The Delete Act added a centralized deletion mechanism a single tool that applies one consumer request across many companies at once, instead of one company at a time.
The law directed the California Privacy Protection Agency (CPPA) the state agency responsible for enforcing California’s privacy laws to build that mechanism. The result is DROP, the Delete Request and Opt-out Platform. It went live in January 2026 at consumer.drop.privacy.ca.gov, and access is free.
A data broker a business that collects and sells personal information about consumers it has no direct relationship with must register with the CPPA every year once it starts operating in California. Registration for brokers active in 2025, or newly active in 2026, ran from January 1 through January 31, 2026, and carries an annual fee of six thousand dollars plus payment-processing costs.
Registering was only the first step. Since August 1, 2026, every registered data broker must log into DROP at least once every 45 days, download the current deletion-request list, and delete the personal information tied to each name on it. A broker that skips registration risks administrative penalties that, under a companion law (Senate Bill 361), can reach $200 per consumer, per day.
More than 600 data brokers had registered with the CPPA by mid-2026, and more than 300,000 Californians had already filed requests through DROP that spring months before the August compliance date arrived.
Real-World Examples of Data Broker Registration and Deletion in California
Scenario one: A Sacramento resident starts getting spam calls after her phone number turns up on a background-check site she never used. Rather than hunting down that company’s individual opt-out page, she files one request through DROP, and it reaches every broker registered with the state, including that one.
Scenario two: A small marketing analytics firm buys and resells consumer profiles built from public records. Because it has no direct relationship with the people in those profiles, it qualifies as a data broker under California law. It had to register with the CPPA by January 31, 2026, and now must check DROP every 45 days for new requests.
Scenario three: A father in Fresno wants his teenage daughter’s information removed from broker databases before she applies for her first job. He submits a request through DROP on her behalf using the platform’s identity-verification process, instead of emailing dozens of broker companies separately.
How People Use California’s DROP Tool, Step by Step
Many people in this situation follow a similar path once they learn DROP exists:
- They confirm they qualify as a California resident, since DROP currently covers requests tied to a California address.
- They visit the official consumer portal at consumer.drop.privacy.ca.gov and start a new deletion request.
- They complete the identity-verification step the CPPA requires before a request moves forward.
- They submit the request once, rather than contacting brokers one by one DROP forwards it to every currently registered broker automatically.
- They check back after a few weeks, since brokers have up to 45 days to act once they access the platform.
- Some also look into ongoing monitoring, since DROP only reaches brokers registered in California and doesn’t automatically resubmit a request as new brokers register later.
Tools That Can Help Beyond What DROP and the CPPA Cover
DROP itself is a free, official tool, and it costs a California resident nothing to submit a request directly. There’s no reason to pay a third party just to reach brokers that DROP already covers.
Where a paid service can add something DROP doesn’t: DROP only reaches brokers registered in California, and one request isn’t automatically repeated as new brokers register or as old profiles get rebuilt from other data sources. A service like DeleteMe monitors a broader set of data broker and people-search sites nationwide and resubmits removal requests on an ongoing basis something worth considering for anyone whose information keeps reappearing after an initial deletion.
Related Articles
- How to Opt Out of Data Brokers 2026 Guide
- CCPA Explained: California’s Privacy Law
- The Right to Be Forgotten: How to Request Deletion
Frequently Asked Questions
What is the California Delete Act?
The California Delete Act is Senate Bill 362, a 2023 California law that added new obligations for data brokers under the state’s existing privacy framework. It requires data brokers to register annually with the CPPA and created DROP, a single online tool consumers use to request deletion of their personal information from every registered broker at once.
How does the DROP tool work?
A California resident creates a request at consumer.drop.privacy.ca.gov and completes identity verification. The CPPA adds that request to a list every registered data broker must download and act on, at least once every 45 days, now that the August 1, 2026 compliance date has arrived.
Who has to comply with the August 2026 deadline?
Every data broker registered with the CPPA including businesses that registered during the January 2026 window and those that register later must access DROP and process pending deletion requests at least once every 45 days, starting August 1, 2026.
Is DROP free to use for consumers?
Yes. Submitting a deletion request through DROP costs California residents nothing. The Delete Act places registration and access fees on data broker companies, not on the consumers requesting deletion.
Conclusion
The California Delete Act DROP system turns what used to be a scattered, company-by-company chore into one request that reaches an entire registered industry. For California residents, that means a single verified submission instead of hundreds of individual opt-out forms.
For data brokers, it means a legal deadline that arrived on August 1, 2026 and isn’t going away. Whether someone is trying to clear an old background-check listing or simply wants fewer companies holding their data, DROP is now the starting point state law provides for that request.
this article is for educational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change frequently. For advice specific to your situation, consult a qualified attorney.
Sources
- California Privacy Protection Agency Information for Data Brokers official CPPA guidance on data broker registration and DROP compliance deadlines
- Privacy.ca.gov About DROP and the Delete Act consumer-facing overview and link to the DROP portal
- California Legislative Information SB 362 (Delete Act) full text the official bill text of the Delete Act
- CPPA Delete Request and Opt-out Platform (DROP) Regulations system requirements for the accessible deletion mechanism
