California’s One-Request Data Broker Deletion System Is Now Live

Opting out of data brokers has historically meant repeating the same request across people-search sites, marketing databases, and identity-resolution services. California’s new DROP system is meant to change that arithmetic. The California Privacy Protection Agency says residents can use DROP to submit a single deletion request to all active data brokers. Starting August 1, 2026, registered brokers must begin processing those requests at least once every 45 days. The system is not a magic eraser. It is a centralized request and accountability layer that still depends on matching, exceptions, broker compliance, and the quality of the information a company holds. What DROP does DROP gives California residents one place to request deletion from active data brokers. The state defines a data broker as a business that knowingly collects and sells personal information about consumers with whom it does not have a direct relationship. The portal changes the request path. Instead of finding every broker independently, a resident submits a request through the state system. Brokers create accounts, access deletion lists, match the requests against their records, process the requests, and report status back through DROP. The matching step matters. Brokers must standardize and hash their own records before comparing them with the request data. That can reduce the need to send a resident’s identifying information repeatedly to dozens of separate websites, but it also means mismatches and stale records remain possible. What the August deadline means The August 1 deadline is the start of broker processing, not the date on which every record disappears. California says brokers must access DROP and process requests at least every 45 days. The state’s guidance also explains that brokers must report request status within the required timeline. The recurring schedule is important because data broker databases change. A one-time deletion request can lose meaning if a broker later reacquires the same information from another source. Regular list checks create a mechanism for continuing requests rather than treating deletion as a single event. The system also gives the state a clearer view of who is participating and who is failing to act. California lists penalties of $200 per day for failure to register and $200 per day per deletion request for failures to delete information as required. What DROP cannot promise Deletion systems face difficult questions about identity, duplicates, fraud prevention, legal retention, and data that a broker receives after a request is processed. California’s portal does not mean that every copy of every data point disappears from every organization instantly. A request may also encounter statutory exceptions or require enough information to distinguish one person from another. Consumers should read the portal’s explanations and keep the confirmation or status information associated with their request. The system does not prevent a company with a direct relationship from retaining information under the rules that apply to that company. DROP is aimed at the data-broker market, not every database in the economy. A better opt-out workflow California residents who use DROP should: Create the account through the official California portal, not a search-ad imitation. Submit the request and save confirmation details. Check status updates rather than assuming a submission equals completion. Revisit the portal when the state publishes new guidance or when personal circumstances change. Reduce future collection at the source by limiting unnecessary account creation, location sharing, and advertising identifiers. DROP is a meaningful infrastructure change because it treats deletion as a coordination problem, not a consumer endurance test. Its success will depend on whether brokers actually process requests, whether matching works for real people, and whether the state enforces the deadlines it wrote.