California has introduced a wide-reaching portal that will allow the state’s residents to tell data brokers to stop selling their personal information, reports TechCrunch. The new system is said to be a first in consumer privacy enforcement and should help drastically cut down on spam and identity fraud.
One-stop petition under California’s Delete Act
The new Delete Requests and Opt-Out Platform, or DROP, implements the state’s Delete Act (SB 362), a 2023 law aimed at simplifying what had been a laborious company-by-company process. And rather than hunting down dozens of people-search sites and marketing databases, a California resident now can file a single verified request that goes to each of the data brokers on the state’s list.
More than 500 brokers have signed up on the registry, which in California includes people-search services, ad-tech companies, risk and fraud analytics providers and marketing list vendors, said a privacy regulator there. The California Privacy Protection Agency (CPPA), which is responsible for the tool, describes DROP as a practical way to help stem the trade in what can include contact details, device identifiers and purchase histories — among other types of data — used to target consumers.
How DROP works, and when deletions begin
Once residency in California is verified within DROP, users can make a universal deletion request to all current and every future registered data broker. The request also serves as a continually effective opt-out, so residents do not need to submit them again if and when new brokers register.
There is a delay before bulk deletions start. Under the Delete Act, brokers are required to begin handling DROP applications in August 2026. They’d then have 90 days to remove the data and report compliance back to the CPPA. If a company is unable to find a consumer’s records, residents can still offer more information to help link their files.
This schedule represents the operational lift for a sector that is predicated on ingesting large quantities of data and linking it together. Brokers will have to map DROP requests to identity graphs, ferret out records across internal systems and vendors, and preserve suppression lists not to retake.
What’s covered under DROP, and what’s not included
The right to delete applies to data brokers — companies that purchase, sell or license personal information they did not collect directly from the consumer. First-party data held by a business that you interact with (an online retailer or bank, for example) is not under the scope of DROP but still falls under your existing rights provided in California’s privacy laws.
Some types of information are not included. There’s nothing in the Delete Act about scrubbing public records including voter rolls and vehicle registrations. Sensitive medical information, which is governed by laws such as HIPAA, has its own rules for deletion and access. The CPPA notes that the DROP initiative focuses on the business transactions of data used for cold calls and exhaustive consumer profile building.
Enforcement and accountability under California’s DROP
The CPPA may impose compliance measures, including $200 per-day fines for brokers who do not register or abide by a valid deletion request as well as enforcement costs. The agency also has the authority to audit practices and ask brokers to certify that they have purged data and suppressed future collection on a request.
California’s approach builds on top of the broader California Consumer Privacy Act and its 2023 amendment, the CPRA, that already ensure rights of access, deletion and opt-out from sale or sharing. DROP takes these rights from theory to scale by allowing deletion at hundreds of brokers at the same time.
What California residents can do now to prepare for DROP
Shoppers can request DROP today to ensure their place in line before the August 2026 processing time begins. In the meantime, residents can continue to individually opt out at major people-search sites and set up Global Privacy Control in their browsers, which serves as a signal under California law when they want to opt out of internet sale or sharing.
Expect tangible benefits over time. In short, the CPPA means fewer unwanted calls, texts and emails as the size of the marketing databases declines, with a corresponding reduction in risk of identity theft, account takeover fraud or AI-driven impersonation scams borne out of exposed personal details.
Why it matters for the data broker economy
The data broker business sector is huge and diverse, ranging from credit header resellers and ad-targeting networks to firms that build “people graphs” for calculating risk. Federal regulators, such as the Federal Trade Commission, have long sounded alarm bells about opaque profiling and its downstream effects of widespread data reuse. DROP, California’s measure, drives the sector toward verifiable deletion workflows and more accountable source tracking.
Other states have toyed with registries and opt-out requirements, but California is the first to combine a centralized consumer tool with legally enforceable deletion mandates on such a wide scale. If adoption is strong — and enforcement visible — anticipate pressure for something similar elsewhere, as legislators and regulators scramble for concrete ways to stanch the flow of personal data that consumers never even realized they were giving away.
