California's Delete Act and DROP: one request to every data broker

California's Delete Act (Senate Bill 362, signed in 2023) told the state's privacy regulator, the California Privacy Protection Agency (CPPA), to build what the law calls an "accessible deletion mechanism". The CPPA describes it as a way for a consumer, "through a single verifiable request," to direct every data broker that holds their personal information to delete it (CPPA data broker page). That mechanism is DROP, the Delete Request and Opt-out Platform.

A data broker, in the state's words, is "a business that gathers and sells consumer information that the consumer didn't give them directly." People-search sites and marketing list sellers are the obvious examples. Brokers that do business in California must register every year, and the current list is the public data broker registry.

The state's consumer page says one DROP request reaches over 600 registered data brokers and that DROP is free: the state will "never charge you to use DROP" (privacy.ca.gov/drop).

You must be a California resident to submit a deletion request. The state says some people can submit for someone else, such as a parent for a child. Residents of other states cannot use DROP, even if California brokers hold their data.

1. Go to consumer.drop.privacy.ca.gov. Type the address yourself or follow the link from privacy.ca.gov: scammers copy government services, and the real one is free.
2. Confirm your California residency through the California Identity Gateway. You can enter details directly or sign in with Login.gov; the state suggests Login.gov only if you already have an account. It says you do not need a Gateway account and that DROP does not keep the information you use to verify.
3. Build your profile. You decide how much to share; the state says brokers need only basic details to find your records. More identifiers (past addresses, other phone numbers, other emails) let brokers match more records, so think about which old details are worth adding.
4. Submit, then check progress later at the DROP status page.

The platform opened to consumers in January 2026, but brokers were not required to start processing straight away. According to the CPPA, starting August 1, 2026, every registered broker must access DROP at least once every 45 days and process the deletion requests waiting for it, and brokers had 45 days from August 1 to process their first batch.

The state warns that status updates can take up to 90 days to show in DROP and that timing varies by broker. A request submitted today should show progress within a few cycles, not overnight.

The state's own page lists the main gaps (personal information and data brokers):

• Public records. Vehicle or real estate ownership and voting records are exempt. Many people-search listings are built from exactly these, so some listings may shrink rather than vanish.
• Data covered by other laws, such as HIPAA (health), the Fair Credit Reporting Act (credit reports) and the Gramm-Leach-Bliley Act (financial institutions). DROP will not remove you from Equifax, Experian or TransUnion; to stop new credit in your name, use a credit freeze.
• Information you gave a company directly. Your bank, your shop accounts and your social media are first-party relationships, not brokers. Use each company's own privacy request.
• Data needed for an investigation, such as responding to a criminal or civil investigation.
• Unregistered or overseas sites. DROP reaches registered brokers. A site that ignores registration is a matter for the regulator, and for you an old-fashioned opt-out.

It also does nothing about Google results. Pair it with Google's free tool in how to remove your information from Google.

You still have options. Every major people-search site has a free opt-out, and our data broker removal guide lists them, with step-by-step pages for Spokeo, Whitepages, BeenVerified and others. Several other states have consumer privacy laws that give residents a right to delete, and Vermont, Texas and Oregon run their own data broker registries. None yet offers a one-stop deletion platform like DROP.

A removal service can do the repetitive part for anyone, in any state, and it also covers sites that list you from public records, where DROP's exemption bites.

This page explains a state program; it is not legal advice. For the full picture of your exposure, take the self-check or browse the privacy hub.