California residents can now use the state’s Delete Request and Opt-Out Platform (DROP) to send one deletion request to active, covered data brokers. The system is not a nationwide privacy law and does not erase information held by every company or website. Consumers could submit requests starting January 1, 2026; brokers began retrieving and processing them on August 1, 2026.
What California’s Delete Act changes
California’s Delete Act, Senate Bill 362, created a state-administered system for routing consumer deletion requests to covered data brokers. The law was signed on October 10, 2023. The California Privacy Protection Agency (CPPA) operates the registry and DROP platform.
As an Amazon Associate I earn from qualifying purchases.
The change is a centralized way to make requests to participating, active brokers rather than contacting each one separately. It does not turn every organization that holds personal information into a data broker, nor does it make every record eligible for deletion.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSee the California Data Broker Registry and the CPPA’s information for data brokers for current platform and compliance guidance.
#1 Best Overall
Who and what the law covers
Covered data brokers
The law generally defines a data broker as a business that knowingly collects and sells consumers’ personal information to third parties when it does not have a direct relationship with those consumers. Statutory exclusions and exceptions apply, including provisions for certain entities or information covered by other laws. A company’s possession of personal information alone does not establish that it is a covered broker.
The CPPA’s Delete Act FAQ explains the statutory scope and exclusions. Whether a particular organization or data set is covered depends on the law’s definitions and exceptions.
Matched information and exceptions
A broker’s deletion duty applies to personal information it can match to the consumer’s request, subject to legal exceptions. The CPPA says matched information includes associated inferences. The statute also restricts a broker from selling or sharing new personal information about a consumer after deleting that consumer’s information, unless an exception applies or the consumer requests otherwise.
These rules concern covered brokers and the information within the statute’s scope. They do not require unrelated websites, employers, retailers, public agencies, or every other organization to delete records through DROP.
How to submit a DROP request
- Open the state platform. Start at the CPPA Data Broker Registry and follow its current link to DROP.
- Submit your request through the platform. Provide the information the state process requires so brokers can attempt to match your request to their records. Use the platform’s current instructions; identity and matching procedures can change.
- Allow time for broker processing. A submission is routed to active brokers, but it is each broker’s responsibility to retrieve, match, process, and report on requests under the law.
- Check the platform for status information. The CPPA’s guidance describes broker status reporting after retrieval. A status is not evidence that information was removed from every source outside the covered broker process.
The platform opened to consumers on January 1, 2026. That date is distinct from the broker-processing start date: brokers began accessing and processing requests on August 1, 2026.
What happens after submission
Beginning August 1, 2026, covered brokers must access DROP at least once every 45 days to retrieve and process requests, subject to limited exceptions. The 45-day interval is a broker access requirement, not a promise that every consumer’s data will be deleted within 45 days of submitting a request.
After retrieval, brokers must determine whether they can match the request, apply the deletion duty to matched information within the law’s scope, and report request status. The CPPA’s November 13, 2025 announcement said request statuses would be reported within 45 days of retrieval. That deadline is measured from broker retrieval, not necessarily from the consumer’s original submission.
Free tools Windows power users keep installed
One-click scans. No signup required.
California’s statute and current agency guidance are the appropriate references for exceptions and individual circumstances. The text of SB 362 sets out the legal requirements.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What DROP does not guarantee
- It is not an all-purpose internet cleanup. DROP addresses covered data brokers, not every business or site that holds information about you.
- It does not promise universal removal. The request is subject to matching, coverage limits, and legal exceptions.
- It cannot be assumed to remove public records or information published directly on websites. The statutory broker process is not a general mechanism for deleting content from every source.
- It does not make a paid service necessary. The state platform is the official starting point for California consumers. A commercial removal service may claim additional scope or follow-up, but the materials cited here do not establish any particular service’s performance.
How to read the rollout dates
| Date | What happened |
|---|---|
| October 10, 2023 | California signed SB 362, the Delete Act, into law. |
| January 1, 2026 | Consumer access to DROP began; the CPPA says the regulations took effect on this date. |
| August 1, 2026 | Broker access and request processing began. |
| At least once every 45 days | Covered brokers must access DROP to retrieve and process requests, subject to limited exceptions. |
The dates and requirements are described in the CPPA’s November 13, 2025 announcement on Delete Act regulations, its current broker guidance, and the statute. The CPPA announced on January 8, 2026 that it had imposed a $45,000 penalty on one company for failing to register and ordered it to stop selling Californians’ personal information. That was a specific enforcement action, not a general penalty amount for every violation.
What California residents should do
If you live in California and want to reduce exposure through data brokers, use the state’s DROP platform and follow its current directions. Treat it as a targeted legal process: it can reach active, covered brokers through one submission, but it is not a single request to every organization that has your data. For information outside that scope, contact the relevant organization directly and consult applicable privacy rights and policies.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
