California enables one-delete requests

Data brokers are the companies most people never hear of but keep running into anyway — in spam calls, sketchy targeting, and dossiers built from scraps of everyday life. California just made a big move against them. Its privacy agency has opened DROP, a government-run system that lets a resident send one request to every registered data broker in the state at once. The old version of this problem was simple and awful: if you wanted out, you had to chase companies one by one. Now the state is trying to turn that into one workflow. (privacy.ca.gov) ### What is DROP, exactly? DROP stands for Delete Request and Opt-out Platform. It is the California Privacy Protection Agency’s central portal for people who want data brokers to delete their personal information and stop selling it. The key point is not the acronym — it is the architecture. Instead of making consumers hunt down hundreds of separate opt-out pages, the state sits in th(privacy.ca.gov)tered broker market. (privacy.ca.gov) ### Why is that a big deal? Because data brokers are unusually hard to deal with one at a time. By definition, many of them collect and sell information about people they do not directly interact with. So a person often does not know which broker has their data, what identifiers the broker uses, or how many separate requests it would take to clean up the mess. California’s fix is basic(privacy.ca.gov)ry. (privacy.ca.gov) ### Who can use it? California residents can. The system asks users to verify residency through the California Identity Gateway or Login.gov, then build a profile with the identifiers they want matched. The agency says users choose how much information to provide, and that the information submitted through DROP is used to complete the request rather than sold onward. In some ca(privacy.ca.gov)nt for a child or a family member for an elderly relative. (privacy.ca.gov) ### How many companies does one request reach? Right now, the consumer-facing page says one request can go to more than 500 registered data brokers. That number matters because it shows what California is actually changing here. This is not a prettier complaint form. It is a centralized mechanism wired into a registry of companies that already have legal duties to register and pay fees. (privacy.ca.gov) ### What happens on August 1? That is when the system grows teeth. Starting August 1, 2026, data brokers must begin processing consumer DROP requests on a recurring cycle. The broker-facing guidance says they have to pull consumer deletion lists every 45 days, delete the covered personal information in their systems, and report status back to the agency. The consumer page frames the pr(privacy.ca.gov) data within 90 days. Both are true — one describes the operational cadence, the other the user-facing deadline. (privacy.ca.gov) ### Why are companies suddenly nervous? Because California is pairing the new tool with tougher enforcement. The agency has already been running sweeps of broker registration compliance, launched a dedicated Data Broker Enforcement Strike Force, and forced at least one broker, Background Alert, into a settlement that shut down operations through 2028 unless it paid a penalty. O(privacy.ca.gov) obligations can pile up fast. (cppa.ca.gov) ### Does this replace the rest of privacy law? Not really. The broker-facing guidance says DROP requests are broader than ordinary deletion requests under the California Consumer Privacy Act and come with different obligations. So this is not one website replacing all privacy rights. It is California building a special-purpose weapon for one especially opaque corner of the data economy. (privacy.ca.gov) ### What is the real bottom line? The real shift is structural. California is no longer just telling people they have a right to ask for deletion. It built the plumbing to make one request travel across an entire regulated industry. If that works, the burden moves off the consumer and onto the brokers — and that is the part other states will be watching. (cppa.ca.gov)