California DROP & the Delete Act: Your Deletion Rights, Explained

For the first time, California residents can tell every registered data broker to delete their information with a single request — instead of filing hundreds of opt-outs one by one. Here's how it works, how to use it, and what it can and can't do.

What is the Delete Act (SB 362)?

The Delete Act is a California law (Senate Bill 362), signed in October 2023, that required the state to build a free, one-stop deletion tool for data brokers. That tool is DROP — the Delete Request and Opt-out Platform — run by the California Privacy Protection Agency (CPPA, publicly "CalPrivacy").

What DROP lets you do that you couldn't before

Under the earlier CCPA, your right to deletion only reached businesses you had a direct relationship with. Data brokers — by definition — collect and sell data about people they've never interacted with, so they were effectively out of reach unless you found and contacted each one. DROP closes that gap: one request reaches every data broker registered in California at once (581 registered as of the CPPA's May 2026 count; CalPrivacy rounds this to "600+").

How to sign up for DROP (California residents)

1. Go to the official platform: privacy.ca.gov/drop
2. Verify California residency — either by entering basic personal information or signing in via Login.gov through the state's California Identity Gateway. The state says this confirms residency without creating an account or storing your info.
3. Create your request with the minimum required details: name, date of birth, and ZIP code. You can optionally add email, phone, previous names, and advertising IDs to improve matching.
4. Submit, and save your DROP ID — you'll use it to check status later.

Cost: Free, by law. You can update your request anytime; updates take up to about 3 months to process.

Key dates

• Oct 2023 — Delete Act (SB 362) signed.
• Jan 1, 2026 — DROP opens; California residents can start submitting deletion requests.
• Aug 1, 2026 — Compliance deadline: registered data brokers must begin accessing DROP and processing requests. Before this date, requests sit pending.
• Ongoing — Brokers must check DROP and act at least every 45 days; each request must be resolved within 90 days.

What DROP does not do

• Only reaches brokers registered in California. Unregistered or non-compliant sites aren't covered, though failing to register carries its own penalties.
• California residents only. Eligibility is gated by California residency.
• Doesn't touch "first-party" data — information you gave directly to a business. Those remain separate CCPA/CPRA requests, company by company.
• Legal exemptions apply — data covered by laws like the FCRA and GLBA may be retained even if matched.

In short: DROP is a powerful additional tool, not a magic delete button. Pair it with direct opt-outs at the biggest people-search sites — see our opt-out guides — for the widest coverage.

Not in California? Here's where you stand

There's no nationwide equivalent yet. A handful of states run data-broker registries (California, Oregon, Texas, Vermont), and Connecticut passed its own DROP-style deletion law in May 2026 — so expect more states to follow. Until your state offers a one-stop tool, your best options are direct opt-outs at the major brokers and any deletion rights your state's privacy law provides. See deletion rights by state .

FAQ

Is DROP free?

Yes.

How many brokers does it reach?

581 registered in California as of May 2026; CalPrivacy says "600+".

Do brokers have to comply?

Yes, beginning August 1, 2026, with recurring 45-day check-ins and penalties for non-compliance.

What if I'm not a California resident?

DROP doesn't apply to you — use direct broker opt-outs and check whether your state has passed a similar law.