California's Delete Act & DROP, Explained: One Request to Delete Your Data From 600+ Brokers
The short version: the California Delete Act (SB 362, signed October 2023) required the state to build a single place where any California resident can tell every registered data broker at once to delete their personal information. That platform — DROP, the Delete Request and Opt-out Platform — went live at privacy.ca.gov/drop on January 1, 2026. It is free, takes under 10 minutes, and covers more than 600 registered data brokers. Brokers were given a runway to connect; starting August 1, 2026, every registered broker must retrieve DROP requests at least every 45 days, act on deletions within 90 days, and keep your data suppressed going forward. More than 300,000 Californians signed up in the first five months.
If you are a California resident, submitting a DROP request is the highest-leverage privacy action available to you in 2026. Here is how it works, what it covers, and where it stops.
What the Delete Act actually requires
The Delete Act (SB 362, Chapter 709, Statutes of 2023) built on California's 2019 data broker registration law and added teeth:
- Annual registration: data brokers must register with the California Privacy Protection Agency (CalPrivacy) every year and disclose what categories of information they collect. The registry hit a record high of 600+ brokers in 2026 (privacy.ca.gov).
- A one-stop deletion mechanism: CalPrivacy had to build a free platform where a consumer submits one verified request that reaches all registered brokers. That is DROP.
- Ongoing suppression: once you submit a deletion request, brokers must not only delete what they hold but also delete information they acquire about you in the future — a structural fix for the industry's relist-after-removal habit.
- Audits and penalties: brokers face compliance audits and administrative fines for failing to register or failing to process deletion requests.
The DROP timeline
| Date | What happens |
|---|---|
| October 2023 | Delete Act (SB 362) signed into law |
| 2024–2025 | CalPrivacy administers broker registry, builds DROP |
| January 1, 2026 | DROP opens — Californians can submit deletion requests |
| June 2026 | 300,000+ consumers registered; 600+ brokers on the registry |
| August 1, 2026 | Brokers must begin processing: retrieve requests at least every 45 days, act within 90 days |
| Ongoing | Brokers re-check DROP every 45 days and maintain suppression |
Two details worth understanding about the runway period: requests submitted any time since January 1 are queued — you did not need to wait for August 1, and there is no advantage to waiting now. And once processing begins, an unresolved deletion request must be treated at minimum as an opt-out of sale/sharing (Byte Back / Hunton).
How to submit a DROP request
- Go to privacy.ca.gov/drop (the official state site — DROP is free; anyone charging for "DROP submission" is a middleman).
- Verify that you are a California resident.
- Create your profile with the identifying details you want deleted (name, addresses, emails, phone numbers).
- Submit. The state reports the whole process takes under 10 minutes on a phone or computer.
- Return any time to check status or update your information.
What DROP does not cover
DROP is the strongest tool of its kind in the country, and it is still not the whole job:
- Only registered California data brokers. Businesses that are not "data brokers" under the statute (they collect your data directly from you — retailers, apps, social platforms) are outside DROP. For those you still use direct CCPA deletion requests.
- Only California residents. Residents of the other 19 states with privacy laws have deletion rights but no central platform — see which rights you actually have in your state.
- Unregistered and offshore sites. People-search sites that ignore the registration requirement are, by definition, not retrieving DROP requests. Enforcement is coming for them; in the meantime they need direct opt-outs.
- Data already in breach dumps. Deletion requests reach brokers' databases, not stolen copies circulating in breach corpora.
- Government records. Public records held by agencies are a separate rail entirely — that is FOIA territory.
Why this matters beyond California
The Delete Act is the template other states are watching. Broker registries already exist in Texas, Oregon, and Vermont, and several states are developing their own. The combination that DROP pioneered — mandatory registration, a central request platform, and forward-looking suppression — is the first regulatory design that actually matches how the data broker industry re-lists people. Expect copies.
Frequently asked questions
Is DROP free?
Yes. DROP is a free state service run by CalPrivacy at privacy.ca.gov. There is no premium tier and no fee. Any third party charging money to "file your DROP request" is adding cost, not capability.
When do data brokers have to act on my DROP request?
Starting August 1, 2026, registered brokers must check DROP at least every 45 days, and determine and act on deletion requests within 90 days of receipt. Requests submitted since the January 1, 2026 launch are queued and will be processed once the mandatory window opens.
Does DROP delete my data permanently?
For registered brokers, the Delete Act requires ongoing suppression: after processing your request, a broker must also delete personal information it acquires about you going forward. That is stronger than a one-time opt-out. It does not reach unregistered sites, non-broker businesses, or already-leaked copies of your data.
Do I need DROP if I already use a removal service?
They cover different ground and stack well. DROP is the legal hammer for the 600+ registered California brokers. A removal or monitoring service covers unregistered people-search sites, breach exposure, non-California brokers, and the verification work of finding out where you actually appear. If you are a Californian, do both: DROP costs nothing.
I'm not in California. Can I use DROP?
No — eligibility requires California residency. Check our state privacy law guide for the deletion rights your state provides, and use brokers' own opt-out processes, which are open to everyone.
Sirveil complements DROP: Sammy, the AI takedown agent, scans 200+ data brokers, people-search sites, and breach databases — including the ones outside California's registry — shows you each finding for a quick "is this me?" check, and prepares the takedowns you review and initiate. $7.99/month or $79.99/year, on Google Play and the App Store.
Sources cited: privacy.ca.gov/drop and CalPrivacy DROP announcements (December 2025, June 2026); SB 362 (Chapter 709, Statutes of 2023); Byte Back (Hunton) DROP analysis (February 2026). Last verified July 2026. This article is general information, not legal advice.