On August 1, 2026, the most significant consumer privacy tool in American history went fully operational. California's Delete Request and Opt-Out Platform (DROP) now requires every registered data broker in California to process consumer deletion requests within 90 days. No exceptions. No excuses.
DROP was created under the California Delete Act (S.B. 362), signed into law in October 2023. While consumers have been able to submit requests since January 1, 2026, brokers were not required to act on those requests until August 1, 2026. That deadline has now passed. The platform is fully enforceable.
This means a California resident can visit one website, submit one request, and legally compel over 600 data brokers to delete their personal information. That is unprecedented.
1 Go to privacy.ca.gov/drop
2 Click "Get Started" and confirm that you are a California resident
3 Verify your identity through the California Identity Gateway — the state's secure digital identity platform. You will need to provide basic identifying information
4 Provide the personal information you want deleted — your name, address, phone number, email, and any other data you want removed from broker databases. The more you provide, the better brokers can match and delete your records
5 Submit your request. DROP automatically sends it to all 600+ registered data brokers at once
6 Track your request through the platform. Brokers must report the status of each deletion within 45 days of retrieving it. Full deletion must happen within 90 days
DROP covers all data brokers registered with the California Privacy Protection Agency (CPPA). As of August 2026, over 600 brokers are registered. These include many of the largest data aggregators, people-search sites, marketing data companies, and information resellers operating in the United States.
The registration requirement applies to any business that qualifies as a data broker under California law — meaning a business that consumers do not directly interact with, but that buys and sells information about consumers from other businesses.
If a broker fails to register, they face fines. If they fail to process a DROP request within the required timeframe, they face additional enforcement action from the CPPA.
Important limitations to understand before relying on DROP alone:
DROP is a major step forward, but it has significant limitations that most coverage does not mention:
| Feature | DROP | Data Removal Service |
|---|---|---|
| Cost | Free | $6-15/month |
| Who can use it | California residents only | Anyone in any state |
| Brokers covered | 600+ registered | Up to 2,414 |
| Unregistered brokers | Not covered | Covered via CCPA email |
| CRA disclosure requests | No | Yes (37+ agencies) |
| Credit disputes | No | Yes |
| Prescreened opt-out | No | Yes |
| Do Not Call | No | Yes |
| Bank opt-out (GLBA) | No | Yes |
| Automatic re-submission | Manual | Continuous |
| Verification of removal | Broker reports status | Automated scanning + screenshots |
If you are a California resident, submit a DROP request immediately. It is free and covers 600+ brokers with one click. There is no reason not to use it.
Then consider what DROP does not cover. The unregistered brokers, the consumer reporting agencies, the credit disputes, the prescreened offers, the telemarketing, the bank data sharing, the continuous re-submission, and the coverage that extends beyond California's borders to protect you everywhere your data exists.
DROP handles one layer of the problem — and it handles it well. A comprehensive privacy service handles the other seven layers that DROP cannot touch.
Think of it this way: DROP is like locking the front door. A comprehensive privacy service locks every door, every window, checks who has your keys, and changes the locks when someone makes a copy.
If you do not live in California, you cannot use DROP. However, the CCPA's deletion rights still apply to any consumer whose data is held by a company doing business in California — which includes virtually every major data broker. This is why services like Vigilant Privacy send CCPA deletion demands on behalf of subscribers in all 50 states. The law protects your data even if you live in North Dakota.
Several other states have passed data deletion laws, and more are expected to follow California's model. Oregon, Texas, and Vermont have the strongest existing protections. As of January 2026, Indiana joined this list. The momentum is toward national coverage, but we are not there yet.
California's DROP portal is a powerful first step. Vigilant Privacy covers the rest — 2,414 brokers, 37 consumer reporting agencies, credit disputes, and comprehensive opt-outs. For everyone in every state, not just California. $9.95/month.
Start Your Free 7-Day TrialNo credit card required. Cancel anytime. We never sell your data.