SIRVEILTMEST. 2025
the-fine-printdropdelete-actdata-brokersprivacy

The Fine Print: Your DROP Status, Decoded

Ben TobinUpdated 5 min read

The Fine Print is a twice-weekly series that reads California's privacy law from the consumer's side: what a word promises, what the text says, and what is left exposed.

The Delete Act required the California Privacy Protection Agency to have its Delete Request and Opt-out Platform, DROP, in place by 1 January 2026 (Civ. Code §1798.99.86(a)). Brokers had to start processing on 1 August, and the agency says they have "up to 90 days to report back with status information" (How DROP works). That puts this fall squarely in the window when statuses fill in.

Each registered broker now shows one of five words next to your request. All five are defined on the agency's own pages. None of the definitions is hidden. But a status screen is read in a few seconds, and each word suggests a little more than its definition says. This guide goes status by status. For the statutory definitions underneath, see our earlier piece, what the statute means by "delete".

Deleted

What it sounds like: that broker no longer has anything on you.

What the agency says: the broker matched you and "has deleted any non-exempt personal information they hold about you" (How DROP works).

What stays: the word doing the work is non-exempt. The Delete Act lets a broker keep data it needs for a purpose listed in Civil Code §1798.105(d), which has eight, or where §1798.145 or §1798.146 says deletion isn't required (Civ. Code §1798.99.86(c)(2), leginfo). Separately, "publicly available" information, including anything "lawfully made available from federal, state, or local government records," is outside the definition of personal information altogether (§1798.140(v)(2), leginfo). The agency's page lists "publicly available data" among the things DROP doesn't cover.

Read the definitions together and a broker that keeps some exempt fields and deletes the rest can show "Deleted." The status doesn't say which fields, if any, remained.

Exempted

What it sounds like: a technicality, or that you weren't covered.

What the agency says: the broker "has information about you but is permitted by law to keep all of it" due to "one or more statutory exemptions."

What stays: everything that broker holds about you. As the agency defines the status, it doesn't name the exemption. Read next to "Deleted," the difference between the two is whether there was anything non-exempt to delete.

Opted-out

What it sounds like: handled.

What the agency says: the broker "couldn't make an exact match based on the information you provided," and "for now, these data brokers still have your data, but they can no longer sell or share it."

What stays: the data itself. The statute is explicit that when a broker denies a deletion request because it can't be verified, it must "process the request as an opt-out of the sale or sharing" of your information (§1798.99.86(c)(1)(B)). That's a real protection. It isn't deletion, and the status screen is where you'd learn which one you got.

Record not found

What it sounds like: they don't have you.

What the agency says: brokers "do not have information about you or could not locate you based on the information you provided."

What stays: possibly nothing. Possibly a full profile filed under an old address, a former surname or a phone number you no longer use. The status covers both cases, and from the consumer's side they look identical. The agency's practical advice is to "add more information to your request to increase the likelihood that a data broker can match you in their records" (Help with DROP). And per How DROP works, brokers that don't find a match "must still hold on to your request," so you don't have to resubmit.

Pending

What it sounds like: in progress, and in hand.

What the agency says: the broker "hasn't processed your deletion request yet."

What stays: everything, for now. Pending is the honest status, and the one most likely to be read as reassurance. Check back after the reporting window rather than assuming.

The case the other way

The statuses are not spin, and it would be unfair to treat them as if they were.

Every definition above is published by the agency in plain language. "Opted-out" reflects a deliberate statutory choice: an unverified request isn't dropped, it becomes a lesser protection instead of none (§1798.99.86(c)(1)(B)). Exempt data a broker keeps "shall only be used" for the exempt purpose and not for marketing (§1798.99.86(c)(3)). Deletion also repeats: once a broker has deleted you, it must delete your personal information again "at least once every 45 days" (§1798.99.86(d)(1)). We covered why that ongoing duty matters in the first DROP cycle.

The merged "Record not found" has a defense too. A broker that can't match you often can't know whether it holds you under other identifiers. A status claiming "nothing held" might be less accurate than one that admits both possibilities.

A fix anyone could carry out

None of this needs new law to start:

  • For the agency: pair each status with a one-line "what this leaves in place," on the status screen itself rather than a separate help page. Where a broker reports "Exempted," or "Deleted" with fields retained, a category of reason (public record, legal obligation, security) would tell the consumer what kind of data remains without revealing it.
  • For auditors and researchers: treat the share of "Record not found" and "Opted-out" results as a measure of matching quality, not only of compliance.
  • For you: add every identifier you can — old addresses, former names, retired email addresses and phone numbers. The statute lets you alter your request once at least 45 days have passed since you last made one (§1798.99.86(a)(4)), and the agency says "updates are allowed once every 45 days." If a broker shows "Deleted" and you still find a listing you believe it controls, the agency's contact form has a category for exactly that: "Data broker did not delete my data." Then search your own name on the sites that worry you, and note the date. A status is the broker's report. What a stranger can still find is a separate question, and the one only you can check.

For how this fits the wider debate about who verifies a deletion status, see our working paper, Who Verifies the Status?, and the plain-language overview of the Delete Act and DROP.

Sources, read 23 October 2026: California Privacy Protection Agency, How DROP works and Help with DROP; Cal. Civ. Code §1798.99.86, §1798.105 and §1798.140 on leginfo.legislature.ca.gov.

Follow Sirveil on LinkedIn: https://www.linkedin.com/company/133457181 · Follow @Sirveil_AI on X.

Disclosure: Sirveil builds privacy verification tools, so we have a commercial interest in this subject.

Sirveil for business: sirveil.ai/for-business

NONE OF THIS CONSTITUTES LEGAL ADVICE.

Share this article

PostShare

Get privacy insights delivered

No spam. Unsubscribe anytime. We send one email per week with new guides and data broker news.

Related Articles

The First DROP Cycle Closes in Mid-September. Nobody Is Going to Email You About It.

Deletion obligations under California's Delete Act began on 1 August 2026. Registered data brokers must access DROP at least every 45 days, which puts the close of the first mandatory cycle in mid-September. Here is what happens in that cycle, what you will and will not be told, and what you can check yourself.

6 min read

You Asked California to Delete You. Here Is What the Statute Means by "Delete."

Most Californians who file a DROP request picture the same thing: their name gone from the companies that trade in it. The statute means something narrower, and the narrowing is done almost entirely by four definitions — who counts as a data broker, what counts as personal information, what counts as a sale, and what deletion permits a company to keep. None of it is hidden. All of it is worth reading before you decide the system failed you.

10 min read

Who Verifies the Status? A Working Paper on Evidence for Deletion Requests

California, Connecticut and Vermont have each written the status of a consumer's deletion request into law, and none says what evidence establishes it. This working paper, submitted to the 2027 ACM Symposium on Computer Science and Law, argues that a status reported only by the data broker is an attestation, not a verification, and proposes a three-state evidence standard.

34 min read

Start protecting your personal data

Scan, verify, remove: Sirveil finds where brokers list you, you confirm which entries are yours, and your takedown requests are prepared, transmitted, and chased on your behalf — tracked end to end.

Get Sirveil

Available now on the App Store and Google Play.