California's DROP Platform: Delete Your Data Footprint [2025]

Your Data Is Being Sold Right Now—California's New Tool Changes That

Every time you scroll through a website, sign up for a service, or make an online purchase, you're generating data. Your browsing habits, location history, purchase preferences, email address, phone number, and more get collected, packaged, and sold to the highest bidder. You didn't authorize this. You probably don't even know it's happening.

Data brokers operate in the shadows of the internet, aggregating personal information from thousands of sources and turning it into a commodity. These companies make billions by selling your data to marketers, insurance companies, employers, and anyone else willing to pay. A single person's data profile might be bought and sold dozens of times before you even realize you're in the system.

But California just changed the game.

On January 1, 2025, the state launched DROP (the Delete Request and Opt-out Platform), a free, centralized tool that lets California residents request the deletion of their personal information from every registered data broker in the state. It's the first comprehensive platform of its kind in the United States, and it represents a major shift in how individuals can reclaim control over their digital identities.

This isn't a minor feature buried in some obscure government website. This is a legitimate, enforceable way to exercise your privacy rights at scale. For the first time, Californians can submit a single deletion request that hits every data broker simultaneously, rather than hunting down dozens of companies individually and sending removal requests one by one.

Let's walk through what DROP actually does, how it works, why it matters, and what you need to know to use it effectively.

TL; DR

• DROP is California's free platform for deleting personal data from all registered data brokers in the state, launched January 1, 2025
• One submission reaches everyone: A single deletion request goes to every registered data broker, eliminating the need to contact dozens of companies individually
• Verification is required: You must verify California residency before submitting requests, preventing abuse and ensuring legitimacy
• Data brokers face penalties: Companies must register annually, process deletion requests by August 1, 2026, and face fines for non-compliance
• Ongoing restrictions apply: Brokers must disclose collected data types, undergo audits, and follow strict handling requirements going forward

Estimated data shows that marketing targeting and insurance pricing are the most common uses of data broker information, highlighting the significant impact on personal and financial decisions.

What Is DROP and Why Does It Matter?

The Delete Request and Opt-out Platform is California's answer to a growing problem that most people don't fully appreciate: the data broker industry operates almost entirely outside of public awareness and legal regulation. Data brokers collect your information from public records, purchase it from retailers, scrape it from social media, buy it from data aggregators, and harvest it from countless other sources. Then they sell it to employers, landlords, marketers, debt collectors, and worse.

You have almost no visibility into what they're collecting, how they're using it, or who they're selling it to. Most people don't even know these companies exist.

DROP attempts to solve this by creating a single point of entry where any California resident can request deletion across the entire industry at once. Instead of spending hours researching individual data brokers and submitting separate requests to each one—a process that most people simply don't do—you can now submit one request through DROP and it cascades to every registered broker.

The California Privacy Protection Agency (Cal Privacy) oversees DROP and enforces compliance. They maintain the registry of data brokers, monitor deletion requests, audit compliance, and levy penalties against companies that don't follow the rules.

This matters because the data broker industry is massive and largely unregulated. Companies operate across state lines, aggregate billions of data points, and profit from selling information about millions of people who never consented to any of it. DROP doesn't eliminate the industry, but it does shift the balance of power slightly toward individuals.

Estimated data shows that international brokers and secondary data pose the highest challenges to DROP's effectiveness, with impact levels of 8 and 7 respectively. Estimated data.

How the DROP Platform Actually Works

Using DROP is straightforward, but there are several steps and important details to understand.

First, you visit the DROP platform website and begin the verification process. California requires proof of residency to prevent abuse and ensure that only eligible residents can submit requests. This typically involves verifying your identity and California address through documents like a driver's license, passport, or utility bill. The verification is instantaneous in most cases.

Once verified, you can submit a single deletion request. This request doesn't ask you to manually select which data brokers to contact. Instead, it automatically routes to every data broker registered with Cal Privacy. You don't need to know their names, websites, or contact information. The platform handles the distribution for you.

You can submit multiple deletion requests if you want—for example, one for yourself, one for a spouse, one for each adult family member. Each request is independent and goes through the same verification process.

After you submit, you receive a confirmation. Cal Privacy maintains a record of your request and monitors whether data brokers are complying with the deletion timeline. Data brokers must begin processing deletion requests starting August 1, 2026. They have a specified window to process requests (the exact timeline varies by broker size and complexity, but the law sets requirements for reasonable timeframes).

Crucially, you don't have to follow up. You don't have to contact each broker individually. You don't have to verify that each one actually deleted your data. Cal Privacy does that work through audits and compliance monitoring.

The platform also allows you to opt out of future data collection and sales. This is different from deletion. Opting out tells brokers not to collect or sell your information going forward. Combined with deletion, this creates a more comprehensive privacy protection.

The Verification Process: Ensuring Legitimacy

Verification is critical to DROP's design. Without it, someone could submit deletion requests for hundreds of other people, essentially weaponizing the system. California requires genuine verification to prevent fraud.

The verification process varies slightly depending on your circumstances, but generally requires:

• Identity verification: You must prove you are who you claim to be. This typically involves uploading a government-issued ID like a driver's license, passport, or state ID card.
• Address verification: You must prove you live in California. This can be done through documents like utility bills, lease agreements, bank statements, or other mail showing your current California address.
• Real-time verification: The platform uses technology to verify documents instantly in many cases. You can usually get verified within minutes.
• Alternative verification methods: If you can't provide standard documents (for example, if you're homeless or don't have a lease), Cal Privacy provides alternative verification methods, typically involving additional identity questions or notarization.

The verification process is designed to be accessible while preventing abuse. It's strict enough that bad actors can't easily submit fraudulent requests, but flexible enough that genuine California residents can verify quickly.

Once verified, your verification status remains active, allowing you to submit additional requests without reverifying each time. This prevents the burden of proving residency repeatedly.

Estimated data shows marketers as the largest purchasers of data from brokers, followed by insurance companies and employers.

Data Brokers and the Registration Requirement

DROP only works if data brokers actually register and comply. That's why Cal Privacy's registration requirement is so important.

Every data broker operating in California must register with Cal Privacy annually. This registration requires them to:

• Identify themselves: Provide company name, contact information, and business address.
• List their services: Describe what types of data collection, aggregation, and sale services they provide.
• Detail collected information: Specify what categories of personal information they collect and aggregate.
• List recipients: Name the types of buyers who purchase data from them.
• Commit to compliance: Agree to process deletion requests and follow all applicable laws.

This registration creates transparency where there was previously opacity. For the first time, Cal Privacy and the public can see how many data brokers operate in California, what they're doing, and who's buying the data.

Registration is mandatory, not optional. Data brokers that fail to register face significant penalties. Those that register but don't comply with deletion requests face additional fines and enforcement action.

The annual registration requirement means the list is updated yearly, helping Cal Privacy maintain an accurate picture of the industry.

What Happens After You Submit a Deletion Request?

Submitting a request through DROP is just the beginning. Understanding what happens next helps set realistic expectations.

Immediately after submission, you receive a confirmation with a request ID number. Save this number. It's your proof of submission and can help you track your request if you follow up later.

Cal Privacy sends your request to all registered data brokers. Technically, they don't send it all at once in the traditional sense. Instead, the request enters Cal Privacy's system, and registered brokers are notified that deletion requests are available for processing.

Data brokers are required to implement processes to handle deletion requests. Larger brokers typically have automated systems for this. Smaller ones might handle requests manually. The law doesn't mandate a specific method, only that they actually process the requests within the required timeframe.

The official processing period begins August 1, 2026. This gives data brokers time to prepare systems and processes before the wave of deletion requests hits. Once processing begins, most brokers are required to complete deletions within 45-60 days, though the exact timeline may vary.

During the processing period, brokers remove your data from their systems. This is thorough deletion, not just hiding your data or marking it inactive. The data should be permanently removed from their databases and backups.

Cal Privacy monitors compliance through audits and investigations. If a broker receives deletion requests but doesn't process them, Cal Privacy can take enforcement action, including fines and legal action.

You don't receive individual confirmation from each broker that your data was deleted. Instead, Cal Privacy's monitoring creates accountability. If deletion isn't happening, the agency investigates and takes action against non-compliant brokers.

DROP effectively deletes various data types from broker databases, with personal identifiers and online activity profiles being the most impacted. Estimated data.

California Joins an Elite Group of States Regulating Data Brokers

California isn't alone in recognizing the data broker problem, but it's definitely a leader. The state is one of only four that currently require data broker registration and operate deletion platforms.

Oregon implemented data broker registration requirements earlier and was working on deletion mechanisms when California launched DROP.

Texas passed data broker legislation and established registration requirements, though their approach differs slightly from California's.

Vermont has some of the oldest data broker regulations in the country and requires registration.

Beyond these four, most states have minimal data broker regulation. The federal government has no comprehensive data broker law, relying instead on fragmented regulations through the FTC and specific statutes like FCRA (Fair Credit Reporting Act), which only covers certain types of data brokers.

This means DROP is genuinely novel. It's the first platform of its kind to provide a centralized deletion mechanism across an entire state's data broker industry. Other states are watching California closely to see if the model works and whether they should adopt similar approaches.

California's leadership on this issue reflects broader privacy concerns and the state's history of leading on technology regulation. The state passed the California Consumer Privacy Act (CCPA) in 2018, which gave residents rights to know what data companies collect, delete personal information, and opt out of sales. DROP extends these rights specifically to data brokers.

The Real Impact: What Gets Deleted?

Understanding what actually gets deleted when you use DROP is important. It's not magic—it deletes the data that data brokers have aggregated, but it doesn't erase everything about you online.

What gets deleted:

• Names, addresses, and phone numbers in broker databases
• Email addresses and online usernames
• Financial information like credit scores, banking details, or income
• Health information the broker has collected
• Purchase history and consumer behavior data
• Location history if the broker has it
• Online activity profiles compiled from web browsing
• Demographic information
• Family relationships and household composition data
• Social media profiles linked to your identity

What doesn't get deleted:

• Your actual social media accounts (those are controlled by the platforms, not data brokers)
• Your online accounts with retailers, banks, or services
• Public records like court filings, property records, or professional licenses
• Information you've published yourself online
• Data held by companies you've directly dealt with (like your bank or credit card issuer)
• Information published about you by news organizations or other publishers

The distinction matters because some people think using DROP will make them invisible online. It won't. It removes you from data broker databases and limits their ability to aggregate and sell your information, but it doesn't affect the original sources of that data or remove information you've posted yourself.

If you've published your address on your Instagram profile, deletion from data brokers doesn't remove that. If you're in a lawsuit and court records are public, those stay public. If a news organization published an article about you, it remains online.

DROP's impact is more surgical: it removes your data from the data broker pipeline. This prevents brokers from selling your information to marketers, employers, landlords, and other third parties. For most people, that's the real value proposition.

Estimated data shows that 70% of the public is unaware of data brokers, highlighting the importance of platforms like DROP for increasing visibility and control over personal data.

Penalties and Enforcement: Making Compliance Mandatory

DROP only works if data brokers actually comply. California's enforcement mechanisms are designed to make non-compliance expensive and risky.

Data brokers that fail to register with Cal Privacy face penalties. The law authorizes civil penalties per violation, which can accumulate quickly. A single company ignoring the registration requirement can face penalties in the thousands or millions depending on how long they operate without registering.

Brokers that register but fail to process deletion requests face additional penalties. The law specifies civil penalties per violation, and each unprocessed deletion request counts as a separate violation. If a broker receives 1,000 deletion requests through DROP and deletes only 500 of them, they've committed 500 violations, each subject to penalties.

Cal Privacy also has investigative authority. The agency can audit data brokers to verify they're actually processing deletion requests, not just claiming to. They can demand records of deletion, inspect databases, and verify that deleted data is actually gone.

For egregious violations, Cal Privacy can refer cases to the California Attorney General for enforcement action. This can include lawsuits seeking injunctive relief (forcing the company to comply), additional penalties, and other remedies.

The enforcement framework creates strong incentives for compliance. It's cheaper and easier for data brokers to actually delete your data than to face investigations, penalties, and legal action.

That said, enforcement isn't perfect. Cal Privacy is a new agency with limited resources relative to the size of the data broker industry. Not every violation will result in enforcement action. But the existence of an enforcement framework changes the calculus for data brokers.

Audits and Ongoing Monitoring: Accountability Beyond Deletion

Deletion is just one part of DROP's regulation. Ongoing audits and monitoring create continuous accountability.

Cal Privacy conducts regular audits of data brokers to verify compliance. These audits examine:

• Deletion request processing: Whether brokers are actually processing deletion requests on schedule.
• Data collection practices: Whether brokers are collecting data from sources they disclosed in registration.
• Data retention policies: Whether brokers are retaining data longer than necessary or justified.
• Security practices: Whether brokers are protecting collected data appropriately.
• Accuracy: Whether collected data is accurate or contains errors and outdated information.
• Resale practices: Whether brokers are selling data only to buyer categories they disclosed.

Audits can be triggered by complaints, random selection, or investigation of suspected violations. Cal Privacy can compel brokers to produce records, databases, and documentation as part of audits.

The audit framework serves multiple purposes. It verifies compliance with deletion requirements, ensures brokers are following disclosure requirements, identifies systematic problems in the industry, and creates deterrence against violations.

Brokers found to have problems during audits are given time to remediate, but continued non-compliance leads to penalties and enforcement.

Using the DROP platform significantly reduces the time required to submit data deletion requests from an estimated 15 hours to just 1 hour. Estimated data.

Timeline: When Will This Actually Happen?

Understanding the timeline is important for setting expectations. DROP didn't start processing deletion requests immediately on January 1, 2025.

January 1, 2025: DROP platform launched for California residents to submit deletion requests.

January 2025 - July 31, 2026: Platform accepts deletion requests, but data brokers are not yet required to process them. This gives brokers time to register and implement processing systems.

August 1, 2026: Data brokers officially begin processing deletion requests. This is when the real work starts.

August 1, 2026 - October 2026 (estimated): Most deletion requests submitted in early 2025 should be fully processed by this timeframe, assuming brokers comply with legal requirements.

Ongoing: Cal Privacy conducts audits and monitors compliance. Annual registration requirements mean the framework continues indefinitely.

The extended timeline between launch and enforcement might seem odd, but it's intentional. Data brokers need time to build systems for processing deletion requests at scale. Many brokers probably didn't have automated deletion systems in place before DROP existed. The 18-month runway allows time for infrastructure changes.

Some brokers have probably already begun preparing. Larger, more sophisticated ones likely started building deletion capabilities as soon as California signaled this was coming. Smaller ones might wait until closer to August 2026.

For California residents, this means you can start submitting deletion requests now with confidence that they'll be processed. The delay between submission and processing is built into the law.

Beyond California: What This Means for the Rest of America

DROP is California-specific. It only covers data brokers registered in California and only applies to California residents. But its impact extends beyond California.

First, it's forcing national data brokers to comply with California law or stop operating in California. Major data brokers operate nationwide, and many don't want to maintain California-specific systems while operating differently everywhere else. This creates pressure to adopt similar practices nationwide.

Second, it's creating a template for other states. Oregon, Texas, and Vermont are watching. Other states are probably considering similar platforms. Within five to ten years, deletion platforms might be available in most states.

Third, it's demonstrating that deletion at scale is technically possible. Before DROP, many assumed the data broker industry was too complex and decentralized to regulate. DROP proves that centralized deletion is achievable with proper regulatory oversight.

Finally, it's creating precedent for federal regulation. If California successfully implements DROP and it reduces data broker harms, momentum could build for federal data broker legislation.

For Americans outside California, this serves as proof that change is possible. The data broker industry isn't immutable. Regulation works. It's just a matter of political will.

Limitations and Gaps in DROP

Dropping is powerful, but it's not a complete solution to data broker concerns. Several important gaps remain.

International brokers: DROP only covers brokers registered in California. Data brokers operating from other countries might not be subject to California law and might ignore deletion requests.

Secondary data: Some data brokers buy information from other data brokers rather than collecting it directly. Deletion from a primary broker might not reach all secondary brokers who bought the same data.

Rebuilt profiles: Even after deletion, brokers could potentially rebuild profiles on you if they re-collect information from the same original sources. The law requires they respect your opt-out, but enforcement is ongoing.

Non-registered brokers: If a data broker operates in California without registering, they're breaking the law, but enforcement depends on Cal Privacy discovering them.

Affiliated companies: The law covers data brokers specifically, but some data aggregation happens through companies in adjacent industries that might not be regulated the same way.

These gaps don't negate DROP's value, but they mean it's not a complete privacy solution. For comprehensive privacy protection, you still need to consider other strategies like monitoring credit reports, being cautious about what data you share online, and using privacy tools.

How to Actually Use DROP: A Step-by-Step Guide

If you're a California resident and want to use DROP, here's exactly what to do.

Step 1: Check eligibility Verify that you're a California resident. DROP is available only to people living in California. If you've recently moved, you might need to update your address first.

Step 2: Gather your documents Before visiting the DROP website, have ready:

• A government-issued photo ID (driver's license, passport, or state ID)
• A recent document proving your California address (utility bill, bank statement, lease, or similar)
• Your email address

Step 3: Visit the platform Go to the official DROP website through the California Privacy Protection Agency. Make sure you're on the official site, not a third-party service (scammers might create fake DROP sites).

Step 4: Start the verification process Click the button to begin verification. You'll be asked for basic identifying information.

Step 5: Upload documents Upload photos of your ID and address verification document. The system will verify these automatically in most cases.

Step 6: Answer security questions The system might ask additional questions to verify your identity. Answer these accurately.

Step 7: Receive verification confirmation Once verified, you'll receive confirmation. This usually takes just minutes.

Step 8: Submit your deletion request Click the option to submit a deletion request. Review the terms and confirm. You can also opt out of future data collection and sales.

Step 9: Receive your confirmation and request ID You'll get a confirmation email with a unique request ID number. Save this.

Step 10: Wait for processing Your request enters the system and will be sent to all registered data brokers. They begin processing August 1, 2026. Most should complete deletion within 45-60 days of that date.

Step 11: (Optional) Monitor compliance You might receive notices from individual data brokers confirming they received and processed your request. These aren't required, but some brokers send them for transparency.

The entire process, from start to confirmation, typically takes 15-30 minutes.

The Future of Data Privacy: Where This Leads

DROP represents a shift in how privacy is regulated. Rather than relying on companies to voluntarily respect privacy, regulation creates enforceable obligations.

This model could expand in several directions. Other states might implement similar platforms. The federal government might eventually create a national version. The system might eventually expand to cover other data uses beyond broker sales.

There's also potential for integration with other privacy tools and regulations. Future platforms might combine deletion requests with CCPA rights (data access and opt-out) in a single interface.

International privacy regulations are moving in similar directions. The EU's GDPR gives residents rights to deletion and data access. Similar regulations are being implemented worldwide. Eventually, data deletion might become a global standard.

For consumers, this suggests a future where privacy rights are more enforceable and data companies face real consequences for violations.

The Catch: What You Still Need to Do

DROP is powerful, but it's not a complete solution. There are important things you should still do to protect your privacy.

Manage what you share online: Every piece of information you voluntarily share becomes a potential data source. Be thoughtful about what you publish on social media, what you tell retailers, and what you submit online.

Monitor your credit: Use free credit monitoring services to watch for identity theft. Data breaches happen, and having visibility into fraudulent accounts is critical.

Use privacy tools: VPNs, privacy-focused browsers, and other tools can limit data collection as you browse.

Opt out of other tracking: Use tools to opt out of people search sites, data aggregators, and marketing databases.

Read privacy policies: Understand what companies are collecting about you and use available opt-out mechanisms.

DROP handles one important piece (data broker databases), but privacy is a multi-layered problem.

FAQ

What is the DROP platform?

The Delete Request and Opt-out Platform (DROP) is a free, government-operated website launched by the California Privacy Protection Agency on January 1, 2025. It allows California residents to submit a single deletion request that reaches every registered data broker in the state simultaneously, requiring those companies to remove personal information from their databases.

How do I verify my California residency for DROP?

Verification typically requires uploading a government-issued photo ID and a recent document proving your California address, such as a utility bill or bank statement. The system verifies these documents automatically in most cases, completing the process within minutes. Alternative verification methods are available if you can't provide standard documents.

When will data brokers actually delete my information?

Data brokers begin processing deletion requests on August 1, 2026. This timeline gives companies time to prepare systems and processes. Most deletion requests submitted in early 2025 should be fully processed by October 2026, assuming brokers comply with legal requirements.

What types of information will be deleted from data brokers?

Deletion covers information aggregated by data brokers, including names, addresses, phone numbers, email addresses, financial information, purchase history, online activity profiles, location history, health information, and demographic data. It does not delete information you've posted publicly, data held directly by companies you do business with, or public records.

What happens if a data broker doesn't comply with my deletion request?

The California Privacy Protection Agency monitors compliance through audits and investigations. Data brokers that fail to process deletion requests face civil penalties for each violation. The agency can investigate non-compliance, compel brokers to produce records, and pursue enforcement action including lawsuits and additional penalties.

Can I submit deletion requests for family members?

Yes, you can submit separate deletion requests for multiple people. Each request requires individual verification of that person's California residency. For example, you could submit a request for yourself, your spouse, and adult children, each with their own verification and request ID.

Does DROP protect me from future data collection?

DROP allows you to both delete past data and opt out of future collection and sales. Opting out tells data brokers not to collect or sell your information going forward. Combined with deletion, this creates more comprehensive protection, though it doesn't prevent companies from collecting information through other means.

Are there any costs associated with using DROP?

No. The DROP platform is completely free. Cal Privacy operates it as a public service. There are no fees for verification, submission, or any other part of the process.

Is DROP available outside of California?

No. DROP is available only to California residents. Other states have different privacy regulations and deletion mechanisms. However, Oregon, Texas, and Vermont have implemented data broker registration requirements and are developing similar platforms.

What should I do if I don't receive confirmation of deletion?

Save your DROP confirmation email and request ID number. While individual brokers aren't required to send confirmation, Cal Privacy tracks compliance through monitoring and audits. If deletion doesn't occur, Cal Privacy investigates and takes enforcement action. Your documentation of submission protects you if you ever need to dispute that your data still exists.

Conclusion: Taking Control of Your Digital Identity

Your personal data has value, and that value is being extracted without your consent. For years, data brokers operated in near-total obscurity, aggregating and selling information about millions of people who had no idea it was happening and no realistic way to stop it.

DROP doesn't solve the entire data broker problem. It doesn't eliminate the industry or prevent all data collection. But it does something powerful: it gives individuals leverage. For the first time, California residents can actually request deletion from all major data brokers simultaneously, with legal backing and government enforcement.

This matters because data broker information is used in ways that directly affect your life. Employers use it for hiring decisions. Landlords use it for rental decisions. Insurance companies use it for pricing. Marketers use it for targeting. Credit agencies use it for scoring. When your data profile contains errors or misleading information, it can have real consequences.

Deletion through DROP doesn't make you invisible. It removes you from the commercial data pipeline so your information isn't being packaged and sold. It gives you back some control over your digital identity.

If you're a California resident, taking the 20 minutes to submit a DROP request is worth it. The timeline between submission and processing is long, but the process is simple and the potential benefits are significant.

For those outside California, DROP serves as proof that change is possible. The data broker industry isn't inevitable or immutable. With political will and regulatory action, individuals can reclaim control over their information. As more states watch California's experiment, we might eventually see similar platforms become available everywhere.

Your data is valuable. You deserve to know who has it, what they're doing with it, and the right to remove it. DROP is a step toward that future.

Key Takeaways

• DROP is a free California platform launched January 1, 2025 that enables residents to request deletion from all registered data brokers simultaneously
• Verification of California residency is required to prevent fraud and abuse of the deletion system
• Data brokers begin processing deletion requests August 1, 2026, giving them 18 months to prepare systems and infrastructure
• CalPrivacy enforces compliance through audits, investigations, and civil penalties against brokers that fail to process requests
• California is one of only four states requiring data broker registration; DROP represents a novel regulatory approach that other states are watching
• Deletion covers data aggregated by brokers but not public records, information you've posted online, or data held by companies you do business with directly
• Combined deletion and opt-out through DROP creates more comprehensive protection, though it doesn't prevent future data collection through other means
• The enforcement framework makes non-compliance expensive and risky, creating strong incentives for data brokers to actually process deletion requests

Related Articles

• Age Verification Changed the Internet in 2026: What You Need to Know [2025]
• 1Password Deal: Save 50% on Premium Password Manager [2025]
• Holiday VPN Security Guide: Expert Tips for Safe Festive Season [2025]
• Punkt MC03: The Privacy Phone That Actually Works [2025]
• iRobot Roomba Data Privacy After Chinese Takeover [2025]
• Should You Use a VPN Browser? Complete Guide [2025]