California's Delete Act and DROP: what one request does, and what it does not

DROP, the Delete Request and Opt-out Platform, is a free website run by the California Privacy Protection Agency (CPPA). If you are a California resident, you verify your residency once, enter a few identifiers, and submit one request. The CPPA says that request goes to over 600 registered data brokers, who were required to start processing it on August 1, 2026, and who must then re-check every 45 days. DROP does not reach data brokers that never registered, it does not cover people outside California, and brokers may keep data the law lets them keep, including publicly available data. This guide covers what the Delete Act says, how to sign up, what DROP covers, and what is left over.

What the Delete Act is

The Delete Act is California Senate Bill 362, passed in 2023 (Chapter 709, Statutes of 2023). It amended the state's data broker registration law. The CPPA's About DROP and the Delete Act page says the agency has administered the data broker registry since 2024, building on California's first registration law from 2019 (AB 1202).

The text of the act, as the CPPA hosts it, defines its subject this way: "'Data broker' means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." It then excludes four kinds of entity "to the extent" they are covered by other laws: the federal Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, California's Insurance Information and Privacy Protection Act, and entities whose processing is exempt under the HIPAA-related section 1798.146.

Three parts matter to a reader:

1. Registration. Section 1798.99.82 says that "on or before January 31 following each year in which a business meets the definition of data broker," the business "shall register with the California Privacy Protection Agency." A broker that fails to register "is liable for" an administrative fine "of two hundred dollars ($200) for each day the data broker fails to register," plus skipped fees and the agency's costs.
2. The deletion mechanism. Section 1798.99.86 told the CPPA to build, "by January 1, 2026," a mechanism that "allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer." That mechanism is DROP. The text says it "shall not charge a consumer to make a request," must support authorized agents, and must let a consumer "selectively exclude specific data brokers from a request."
3. Processing. The same section says that "beginning August 1, 2026, a data broker shall access the accessible deletion mechanism" "at least once every 45 days" and process the requests it finds there. After deleting, the broker "shall delete all personal information of the consumer at least once every 45 days" and "shall not sell or share new personal information of the consumer," with exceptions. From January 1, 2028, brokers are to undergo a third-party audit every three years.

Read the statute text before relying on any of it. Whether a given company counts as a data broker is for the text and the CPPA to decide, not this article.

How to sign up for DROP

The CPPA's sign-up page shows three steps: check eligibility, fill out the request, submit the request.

1. Verify that you are a California resident. The CPPA's How DROP works page says you qualify if you live in California or are "domiciled in California, but outside California for a temporary or transitory purpose." Residency is checked through "the California Identity Gateway, which is the state of California's secure digital identity platform." The eligibility page offers two routes: sign in with an existing Login.gov account, or "verify your residency by entering your personal information." The CPPA says the gateway checks residency "without the need for an account or the retention of your data."

2. Create your profile. You can add names, dates of birth, ZIP codes, email addresses, phone numbers, mobile advertising IDs, connected TV IDs and vehicle identification numbers. The CPPA says: "You only need to provide your name, date of birth, and ZIP code to submit a request." The help page says the optional identifiers exist "to increase the chances that a data broker can find your information in their records," and the How DROP works page says: "The more information you enter, the more likely your data will be deleted."

3. Submit the request. You receive an 8-digit DROP ID on the confirmation page; the CPPA says you can also request it by email and recover it if you lose it. Keep it; you need it to check your status.

What happens next. The CPPA's help page says: "On August 1, 2026, data brokers are required to start processing requests. Updates could take up to 90 days to show up in DROP." The How DROP works page adds that after initial processing, "data brokers must re-check and delete new matching data at least every 45 days." The DROP home page adds that by November 2026 "all data brokers in DROP should have completed their initial download and upload cycle."

Two notes from the help page: profile updates "are allowed once every 45 days," and a status of "record not found" means "the data broker couldn't find a match based on the information provided." That is not a refusal. It can mean the broker never had you, or could not match the identifiers you gave. The help page also says you "may submit a request on someone else's behalf through DROP, for example a parent may submit for a child, with their permission."

What DROP covers

DROP reaches the data brokers on the CPPA's registry. The CPPA's DROP page says you can "send one request to over 600 registered data brokers." Its press releases give the trajectory: on June 2, 2026 the agency reported 581 registered brokers, "the highest number of registrants since the registry was established in 2020," and more than 300,000 Californians signed up. On August 25, 2026 it reported more than 500,000 Californians registered and that "654 data brokers are now part of the system."

The same August release gave the first results after the August 1 deadline: about 25% of the 654 brokers had reported processing requests, 99.9% of consumers had their profile deleted by at least one broker, and the typical user had been removed by "over 40 brokers." Those are the CPPA's figures a few weeks into processing; the rest had not yet reported processing.

To check whether a specific site is covered, open the CPPA Data Broker Registry. It lists each registered broker and lets you download the full registration data as a CSV. Our data broker directory notes CPPA registration on a broker's page where we have checked it.

What a registered broker is told to delete, per the How DROP works page: "All of the data that the data brokers have about you will be deleted, with a few exceptions." The exceptions are the next section.

What DROP does not cover

Brokers that never registered. The statute says the mechanism allows "data brokers registered with the California Privacy Protection Agency" to check for requests. A company that is not on the registry is not looking at DROP. The CPPA has been fining unregistered brokers: in January 2026 it announced fines of $45,000 against Datamasters and $62,600 against S&P Global for failing to register, and on August 13, 2026 it fined Cybba, Inc. $52,400 and ordered it to access DROP. The gap is real, and it closes one company at a time.

People outside California. The CPPA says plainly: "DROP is only available to California residents."

Data the law lets a broker keep. The How DROP works page lists three categories a broker may keep: "Data given directly to a business (first-party data)," "Exempted data," and "Publicly available data." The statute says a broker "shall not be required to delete a consumer's personal information" if keeping it is "reasonably necessary" for a purpose listed in section 1798.105(d) of the CCPA, or if "the deletion is not required pursuant to Section 1798.145 or 1798.146." Data kept under these exceptions "shall not be used or disclosed for any other purpose, including, but not limited to, marketing purposes."

Entities excluded from the definition. The four exclusions quoted above (FCRA, Gramm-Leach-Bliley, the insurance act, the HIPAA-related exemption) mean that a credit bureau's regulated files, a bank's customer data, an insurer's records and a health provider's records are not what DROP is for.

Data that was already sold. A DROP request goes to the broker. The statute's "shall not sell or share new personal information" clause applies after a broker has deleted your data. The CPPA pages we read say nothing about copies a broker sold before it processed your request.

Re-collection. The statute's answer is the cycle: after deletion, a broker "shall delete all personal information of the consumer at least once every 45 days." By the CPPA's own August figures, about a quarter of brokers had reported processing at all, so the cycle is new and unproven at scale.

Enforcement is new. The fine for not deleting, per the statute, is "two hundred dollars ($200) for each deletion request for each day the data broker fails to delete information." Whether and how fast the CPPA uses that clause against brokers that ignore DROP is something to watch in its announcements, not something to assume.

DROP and people-search sites

People-search sites are the pages that show your address, phone number, age and relatives to anyone who types your name. Many sell data they collected without a relationship with you, which is the activity the act's definition describes. Whether a given site is on the registry is something to check per site.

The CPPA's Background Alert case shows the gap. In February 2025 the agency announced that the operator of backgroundalert.com, a site that amassed "billions of public records" and generated inferences about who a searched person "may somehow be associated with," had failed to register in 2024 and agreed to shut down its data broker business through 2028. A company in that position is not on the registry, and the statute only lets registered brokers check DROP for requests.

The honest procedure:

1. Submit your DROP request first. It is free and covers every registered broker at once.
2. Search your name and note which people-search sites still show you.
3. Look each one up in the CPPA registry. If it is listed, give DROP its 90 days and check your status. If it is not listed, use the site's own opt-out.
4. Our people-search directory has a step-by-step guide per site for the ones we have tested, and How to remove your information from the internet gives the full order of work. For who these companies are, read What is a data broker.

Keep in mind that the CPPA says publicly available data may be kept, and some people-search listings are built from public records. A broker can report "Deleted" in DROP while a listing built from public records stays up. A search of your own name is how you confirm the 45-day re-check did its job.

If you are not in California

DROP is California-only. Other states have their own data broker laws and registries. Texas runs a searchable Data Broker Registry at the Secretary of State, and Oregon's Division of Financial Regulation publishes the registrations it collects under HB 2052. Neither page describes a one-request deletion platform like DROP. What applies to you depends on where you live and on each law's scope, which we do not assess here.

For everyone outside California, the route is the one in How to remove your information from the internet: take an inventory, use each site's opt-out, and re-check on a schedule.

Do you still need a removal service?

If you live in California, use DROP first. It is free, it is the official route, and the CPPA says it reaches over 600 registered brokers in one submission. A service that charges you for what DROP does for free is not adding value.

What a service can add, in our view, is the layer DROP does not reach: brokers and people-search sites that are not on the registry, listings built from publicly available data, and everything for people who do not live in California. The other thing to ask for is proof per site: a before-and-after of the actual listing and a re-check after the broker's refresh cycle, because a "Deleted" status in DROP and a listing that is gone from a search are two different things. We cannot promise any listing stays gone; nobody can, which is why the statute's 45-day re-check cycle matters.

FAQ

Is DROP free? Yes. The CPPA's DROP page says it will never charge you to use DROP, and the Delete Act text says the deletion mechanism shall not charge a consumer to make a request.

Can I use DROP if I do not live in California? The CPPA says DROP is only available to California residents. Residency is checked through the California Identity Gateway. The CPPA's help page says you may submit a request on someone else's behalf with their permission, for example a parent for a child.

Does DROP remove me from people-search sites? Only from the ones that are registered with the CPPA. DROP reaches registered data brokers. A people-search site that has not registered is not in DROP, so check the registry and use the site's own opt-out for the rest.

How long does DROP take? The CPPA's help page says: "On August 1, 2026, data brokers are required to start processing requests. Updates could take up to 90 days to show up in DROP." The Delete Act text says that beginning August 1, 2026, a data broker shall access the deletion mechanism "at least once every 45 days" and, "within 45 days after receiving a request," process the deletion requests it finds there.