On January 1, 2026, the Delete Request and Opt-out Platform (DROP) opened for business, making it easy for Californians to delete their information from the hundreds of registered data brokers and prevent them from selling that information, rights granted under the California Consumer Privacy Act.
Legislative History
In 2018, California passed the first comprehensive data privacy legislation in the United States, the California Consumer Privacy Act (CCPA). Two years later, voters passed Proposition 24, the California Privacy Rights Act of 2020 (CPRA), which created the California Privacy Protection Agency (CPPA).
In 2023, the state passed the California Delete Act (SB 362), a bill unanimously supported by the CPPA Board. It requires data brokers to register with the CPPA and requires the agency to "establish an accessible deletion mechanism" that allows consumers to "request the deletion of all personal information related to that consumer through a single deletion request". Data brokers were previously required to register with the Attorney General from 2020 to 2023, and the Office of the Attorney General continues to host the registries for those years. Under the act, data brokers are required to delete the personal information of a consumer who submits a request every 45 days.
How the Data Deletion Request Works
-
Verify that you are a California resident
If you live in California or are domiciled in California but temporarily away, then you are a resident. The full definition of a California resident is codified in the Franchise Tax Board's regulations.
This is verified through either Login.gov, the federal government's single sign-on platform (developed by now-defunct 18F), or the California Identity Gateway, a new platform developed by the state Department of Technology that "allows services to confirm eligibility while protecting your privacy".
-
Create your profile
Your profile includes data that helps data brokers match your information to the information they already have so they can delete it. Your information is not given to the data brokers; instead they receive a hashed form that they recreate with their information to match.
-
Submit your request
Make sure you save your DROP ID on the confirmation page. You will use it to check the status of your request.
Data brokers are required to begin deleting data every 45 days on August 1, 2026.
The detailed list of steps is available on the agency's consumer website.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.