California's One-Request Data Broker Deletion Tool Passed 560,000 Sign-Ups in 2026

On New Year's Day 2026, staff at California's privacy agency watched deletion requests come in as people filed them. "The holiday, it was New Year's Day, and we were seeing requests kind of come in in real time," Marissa Rosemblat, the agency's assistant deputy director for the Delete Act, later told its board. Within 48 hours there were more than 18,000.

Each of those requests went, by default, to every data broker registered with the state. Data brokers are companies that collect and sell personal information, and the state's public list of them, called the registry, runs to more than 500 companies. Until that day, a Californian who wanted out had to ask each broker one at a time. In 2024, about 150 registered brokers told the state that they had not received a single deletion request, Bloomberg Law found in the companies' own disclosures.

The new system is the Delete Request and Opt-out Platform, or DROP, run by the California Privacy Protection Agency, which calls itself CalPrivacy. By Oct. 12, the agency said, more than 560,000 Californians had signed up, and brokers had reported deleting close to 100 million consumer profiles. Every sign-up figure the agency has released is phrased as "more than" a number, which makes it a floor: the real count was at least that high, not exactly that. The deletion figures are the brokers' own reports.

Californians signed up in a rush, then slowly, then quickly again in the weeks around Aug. 1, the date brokers had to start acting on the requests. What the brokers did with those requests is only now coming into view.

Nov. 1 was the first deadline for brokers to report back on every request. The agency's estimate of what it costs to run DROP and the rest of its broker work has grown well past the figures lawmakers saw in 2023. And no broker had been fined for failing to process a request, as of the agency's Oct. 12 release, which was still its latest on Nov. 6.

This story looks at two things. The first is how fast people used a privacy right once it took one request instead of hundreds. The second is what the record shows happened to those requests.

A rush, a lull and a second rush

Gov. Gavin Newsom announced the tool on Jan. 20. By then, state officials said, more than 155,000 Californians had used it. "Your data should belong to you, and DROP will make that happen in one simple step," he said.

Sen. Josh Becker, in the same release, said he wrote the bill "to give people real control over their personal information and protect them from scams, identity theft, and spam emails." Those are outcomes the sign-up figures cannot measure.

The first two days were not the peak. One later day brought more than the first two combined. Artem Andrusov, the agency's chief of information technology, told the board in February that the busiest day so far had brought 30,000 requests, and the busiest hour 2,136. He did not say which day.

Signing up takes more than a click. Each user has to verify California residency. Staff said about 98% of people who try pass that check, and the average request takes eight minutes.

The chart below shows how quickly those sign-ups added up.

Cumulative DROP sign-ups as announced; each figure is a "more than" floor. Source: CalPrivacy; ABC 10News; IAPP.

The count passed 240,000 in DROP's first eight weeks. The next announced milestone, 300,000, came about three months later.

Staff told the board in February that consumer interest had been "driven largely by positive unpaid press and social media coverage." At the same meeting, Megan White, the deputy director for public affairs, said one Instagram post explaining DROP "was viewed more than 2.7 million times, and that video was shared more than 10,000 times."

From launch to Jan. 20, sign-ups averaged about 8,200 a day. From late February into July, they averaged about 600 a day. Then, in late summer, the pace picked up again.

Those rates are our estimate, made by dividing the gap between each pair of announced counts by the days between them. Because every input is a "more than" figure announced on an irregular date, they are approximations, not measurements.

Average new sign-ups per day between announced counts, our calculation from published floors. Source: CalPrivacy and press counts.

From July 10 to Aug. 25, sign-ups averaged about 3,800 a day, the fastest stretch since January. Two other figures fall inside that stretch, and they came from Bloomberg Law and the governor's office rather than the agency.

Bloomberg Law reported more than 350,000 registered on July 31. On Aug. 13, the governor's office said that "Over 475,000 Californians have already requested their data to be deleted."

Between those two dates, 13 days apart, the figures rose by about 125,000. Both are minimums, from different publishers, and the governor's figure counts people who "requested" deletion rather than registrations. So the true gain could be larger or smaller.

The paid advertising had ended before that stretch began. Staff told the board in August that the agency's DROP ad campaign ran only in 2026 and drew more than 350 million impressions. They said it ran "through the end of the media buy contract in late June," and that "all advertising concluded in June of this year."

Several things landed in the same weeks. Brokers had to begin processing DROP requests on Aug. 1, the governor's office issued its release on Aug. 13, and the agency announced fines against two brokers on Aug. 11 and Aug. 13. The sign-up counts cannot show which of them, if any, brought people in.

By Aug. 25 the agency counted more than 500,000. "The Delete Act is working exactly as intended by giving Californians real control over their personal information and holding data brokers accountable," Becker said that day.

About one Californian in 70

More than 560,000 people is about 1.4% of California's 39.2 million residents, or about one in 70. Measured against adults alone, the share is 1.8%. Neither share is exact, because a parent can file for a child and a family member for an elderly relative.

The closest national comparison is the Federal Trade Commission's Do Not Call Registry. "We're very pleased that beginning today, consumers can make the call on whether to get telemarketing pitches at home," FTC Chairman Timothy Muris said when it opened on June 27, 2003. In its first five weeks, the FTC said, consumers registered more than 30 million telephone numbers, including 3.4 million in California. DROP, in a little over nine months, signed up more than 560,000 Californians.

Those counts are of phone numbers, not people, and one household can register several. The two lists also asked different things of the people using them. Do Not Call asked for a phone number; DROP asks each person to prove California residency.

So the counts compare the size of each response. They cannot say which right people valued more.

Whatever its size, the response was to a problem lawmakers had argued over three years earlier.

One request instead of 500

California's main privacy law, the California Consumer Privacy Act (CCPA), already gave people the right to ask a business to delete their data. Becker, a Menlo Park Democrat, introduced the Delete Act in April 2023. He argued then that the right missed the companies that matter most here: brokers that buy data rather than collect it from the consumer.

His office's press release that month explained that a person could make a broker delete information it collected directly from them, but not information it got about them from other sources. "The loophole in the law is big enough to drive a few million stolen identities through and it's time to close it," he said.

The registry, in theory, told people whom to ask. Becker's statement in the Senate floor analysis described what that meant in practice: "Currently, the data broker registry is impractical because it requires Californians to request each of the more than five-hundred registered brokers to delete their personal information, a practically impossible task for all but the most concerned consumers."

Privacy Rights Clearinghouse, a nonprofit privacy advocacy group that sponsored the bill, made the same case to the Senate Judiciary Committee. "The current deletion process is time-consuming and practically impossible for even the most dedicated consumers, but especially for those with limited access to technology or facing language barriers," it wrote.

The one-at-a-time system left a paper record, because brokers report their deletion figures to the state each year. A Bloomberg Law review of those disclosures found that most brokers reported complying with millions of deletion requests in 2024, and that nearly 890,000 were denied.

Some well-known companies reported few requests, Bloomberg Law found. General Motors received 200 requests that year, by its own disclosure, and Marriott International fewer than 350.

Each side has its own explanation for the denials. In their disclosures to the state, some brokers attributed denials to what they called "bogus" or incomplete requests and to trouble verifying identities; David Stauss, whose law firm represents data brokers, described requests filed on behalf of "Harry Styles" and "John Doe." "The brokers can't be trusted to audit themselves," said Rachel Vrabec, chief executive of Kanary, a company that sells data-removal services.

In one test, opting out by hand worked better than paying a service to do it. Consumer Reports, which supported the Delete Act, ran that test in 2024 with 32 volunteers and 13 people-search sites. It found that manual opt-outs removed 70% of profiles within a week. Seven paid removal services removed 0% to 58.7% in the first week.

The best two of those services, EasyOptOuts and Optery, reached 65% and 68% after four months. Optery said "The study's design significantly handicapped the data removal services from the start."

The Delete Act proposed to replace all of that with one request. The industry spent the summer of 2023 trying to stop it.

The fight in Sacramento

In September 2023, the bill's final weeks, the industry took its case to the streets of Sacramento. The Consumer Data Industry Association, the trade group for credit bureaus, background-check companies and other consumer reporting agencies, sent mobile billboard trucks around the capital and put up a website called NotoSB362.org. The bill, SB 362, had already cleared the Senate 32-8 on May 31.

"This bill would cause a massive ripple of unintended consequences on people's everyday lives and California's entire economy," said Dan Smith, the association's president and chief executive. He said it "would undermine consumer fraud protections, curb small businesses' ability to compete, hurt mission-driven nonprofits, and empower third-party 'pay to delete' services at consumers' expense."

The association, which is funded by its member companies, had made its most specific prediction in an August letter to the Assembly's appropriations chair. "If a significant number of California residents are deleted from those datasets, the data will become deeply corrupted and increasingly incomplete, inaccurate, and unusable," it wrote. Chad Engelgau, president of the data broker Acxiom, wrote on LinkedIn that the bill could "easily destroy" California's data-driven economy, The Record reported.

Other opponents pointed to the work brokers do for other businesses. The California Chamber of Commerce told the Judiciary Committee that brokers support anti-money-laundering, sanctions-compliance, cybersecurity and underwriting work. Sunder Ramani, a leadership council chair at the National Federation of Independent Business, wrote that the bill would make it "nearly impossible for small businesses to attract new customers."

Supporters spoke about the same companies in different terms. "With hundreds of data brokers on the data broker registry, it is practically impossible for consumers to delete their data with each business one-by-one," said Jennifer Urban, chair of the state privacy agency's board, which voted unanimously to back the bill. Planned Parenthood Affiliates of California said the bill would "ensure that data cannot be weaponized" as abortion access came under attack.

"This bill is highly significant and does provide a really meaningful consumer right that a lot of data brokers don't want to provide because they know that it's going to strike at the heart of their business," Matt Schwartz, a policy analyst at Consumer Reports, told The Record. The Senate floor analysis listed 24 opponents, among them Experian, TransUnion and the California Bankers Association, and 35 named supporters, among them Attorney General Rob Bonta, the Electronic Frontier Foundation and Consumer Reports.

Two other warnings went to the details. The first was about the tool itself. An advertising-industry coalition including the Digital Advertising Alliance said one request to every broker "would serve as a very blunt instrument that would not provide consumers with the ability to make granular choices."

Amid resistance from businesses, Becker changed the bill, the Los Angeles Times reported. Consumers could exclude certain brokers, and brokers would delete a consumer's personal information at least once every 45 days, where an earlier version had given them 31 days.

The second warning was about money. The state privacy agency told the Assembly Appropriations Committee it expected costs of "about $1.14 million in fiscal years (FY) 2024-26 and $600,000 in FY 2026-27 and ongoing." The state's fiscal year runs from July 1 to June 30. The industry association wrote that "the cost estimates for establishing and maintaining this new government program grossly underestimate the actual costs."

The Assembly passed the bill 52-14 on Sept. 13. "The new rules passed despite fierce lobbying from the data broker and advertising industries," The Record wrote. Gov. Gavin Newsom signed it on Oct. 10, 2023, and the law gave the agency until Jan. 1, 2026 to build the deletion tool.

In 2023, the Chamber of Commerce had warned that the agency was already behind on its regulations. The agency launched DROP on Jan. 1, 2026, the deadline the law set. Seven months later, the requests it had collected became the brokers' work.

What the brokers report doing

On Aug. 1, 2026, brokers had to start acting. Under the agency's regulations, from that date each broker must log in to DROP at least every 45 days, collect the requests and report the status of each one within 45 days of retrieving it. That repeating 45-day round is DROP's deletion cycle.

The statuses fall into five categories: "deleted," "exempt," "opted-out," "record not found" and "pending." The agency tells users the results can take up to 90 days to appear.

Few users had looked by early August. At the board's Aug. 7 meeting, after a staff member refreshed a dashboard, Rosemblat said, "So approximately 10% have come back to check status already." Board member Nicole Ozer said she had filed on Jan. 2 and kept her DROP ID "somewhere eight months ago, but I don't remember where I kept that." Rosemblat told her she was "not the only person who has lost their DROP ID."

On Aug. 25, the agency said 654 brokers were "part of the system" and that about 25% had reported processing requests. Brokers had reported deleting "tens of millions of records," and the typical user had had information removed by more than 40 brokers.

By early October the numbers had moved. On Oct. 9, Bloomberg Law reported, citing a state official, that brokers had reported more than 60 million profile deletions. Bloomberg Law also reported that Rosemblat had told an IAPP conference in Seattle that two-thirds of the roughly 650 registered brokers had accessed DROP and responded. Three days later the agency put the figure at close to 100 million profiles and said a typical user had information reported deleted by more than 150 brokers.

Those figures carry two limits. First, they are brokers' own reports, which the agency compiles, and the first mandatory independent audits of brokers begin Jan. 1, 2028. Second, "typical user" is not defined on any agency page we read, so the August and October figures may not measure the same thing.

How many brokers are there to report? Brokers must register with the state each year, but the agency's own numbers do not agree.

The registry files listed 542 unique broker names in 2024, 540 in 2025 and 625 in 2026 through Oct. 30. The June figure of 581 was, the agency said, "the highest number of registrants since the registry was established in 2020."

Some of the difference may come from who is being counted. The agency's page for brokers names two kinds of fee. It tells them to "Pay access or registration fee, depending on when you began brokering data," and its August board materials counted two groups: "580+ data brokers registered, 600+ active in DROP." Neither explains why the registry file lists 625 names while the agency's releases cite 654 or 660, so we report the counts side by side rather than choose one.

Who pays to run it

Running DROP has cost more than the agency planned. At the August board meeting, staff said "our previous assumptions, even for the 26-27 fiscal year, didn't account for these increased volumes."

A staff memo for that meeting estimated the cost of running the agency's broker program at "$6 million in fiscal year 2026-27 and $5.5 million in fiscal year 2027-2028." That is ten times the $600,000 a year lawmakers were given in 2023 for the same fiscal year. The two figures do not count the same things. The 2023 estimate left out enforcement staffing, and the 2026 memo covers running the registry and enforcement as well as DROP. So the ratio of ten compares estimates of different scope. It does not measure by itself how far the 2023 estimate missed.

The memo used that estimate to set the yearly fee brokers pay to register and use DROP. It recommended "adjusting the registration fee from $6,000 to $9,500 for calendar year 2027."

Brokers objected at the meeting. Ben Isaacson of In-House Privacy, a firm whose clients include registered brokers, said "this $3,500 increase will come at a significant strain on the registered data brokers who have not budgeted for that increase," and a New York list broker asked for a fee scaled to revenue. The board voted 4-0, with member Alastair Mactaggart not voting, to direct staff to raise the fee. Whether the change has completed the rulemaking process was not confirmed in the records we read.

Fines so far

The agency's Delete Act enforcement so far has been about registration. By Sept. 3 it said it had brought more than a dozen actions against unregistered brokers, and the late-summer orders came close together.

On Aug. 11 it ordered LocateSmarter, an Iowa broker, to pay $116,490 for registering late and for requiring Californians to give partial Social Security numbers before they could opt out. It was the agency's first action against a broker under both the privacy law and the Delete Act. Two days later Cybba, Inc. was fined $52,400 for missing the 2025 registration deadline, and on Sept. 1 SalesIntel Research of Virginia was fined $36,400 for registering late. The Cybba and SalesIntel orders both required the companies to use DROP.

"The Enforcement Division will continue using all the tools at its disposal to protect Californians' privacy, including publishing advisories to help stop violations from happening in the first place," said Michael Macko, the agency's head of enforcement.

The larger penalty is one the agency has not yet used. The law sets a fine of $200 a day per consumer for a broker that fails to delete as required, plus the agency's costs. "The Delete Act, in my opinion, fairly objective, is the most impactful statutory penalty law in the United States related in any way to privacy," Isaacson said, Bloomberg Law reported in October.

Isaacson also named a date. "Really Nov. 1, which is pretty soon, is the first opportunity CalPrivacy will have to enforce that $110 million per day penalty," he said. His figure equals $200 times 550,000, the number of Californians the agency counted at the start of October. It is a ceiling that assumes a broker failed every request.

Brokers had until Nov. 1 to report whether they found and deleted each consumer's data, Bloomberg Law reported. Through Nov. 6, the agency's newsroom showed no penalty for failing to process a DROP request. Its latest release was dated Oct. 12.

The board met in San Francisco on Nov. 5 and 6, and its posted materials reported no new DROP sign-up or deletion figures. They said formal rulemaking on broker audits and "DROP Updates" would open in November, with public comment closing in December 2026.

What changes on Jan. 1, 2027

The legislature has already shortened the deletion cycle. In August, the Assembly voted 71-2 to accept the Senate's changes to AB 883, a bill by Assemblymember Lowenthal. Newsom signed it on Sept. 27, 2026.

Under AB 883, from Jan. 1, 2027, brokers must process requests at least every 30 days, close to the 31 days in an earlier version of SB 362 that Becker changed in 2023. AB 883's provisions on deletion requests for elected officials and judges take effect July 1, 2027.

Newsom signed Becker's SB 923 the same day. It takes on the loophole Becker described in 2023. It extends the privacy law's general deletion right to data a business got from third parties, not only data it collected from the person. It also takes effect Jan. 1, 2027.

The court fight a 2025 Georgetown Law Technology Review article predicted has not arrived. "Well-funded litigants, including data brokers and trade associations, will likely argue that the Delete Act violates the First Amendment by limiting the sale of personal data," it said. The First Amendment is the Constitution's protection of free expression. The article itself concluded that laws limiting data brokers’ sale of personal data are constitutional under the First Amendment.

We found no such suit against California as of Oct. 31. The Do Not Call Registry faced an industry First Amendment challenge too. In early 2004, when the FTC chairman said the Tenth Circuit Court of Appeals had upheld it, consumers had registered 57.8 million numbers.

The agency has said it would review DROP's activity and processing outcomes from the first 90 days after Aug. 1, which ran to about the end of October. No such review had appeared in the agency's newsroom when we checked on Nov. 6.

DROP turns one on Jan. 1, 2027, the day the 30-day cycle begins. Broker registration for 2027 is due Jan. 31, at a fee that may be $9,500.

On New Year's Day, the agency's staff could watch each request arrive. Ten months on, the agency's latest count is more than 560,000 Californians, and what happened to their requests reaches the agency through the brokers' own reports. The agency's DROP page tells each of those people what to expect: "Results will vary by consumer and may take time to notice."

How we measured

Sign-ups. Every DROP count is a figure announced by CalPrivacy (the California Privacy Protection Agency) or reported from state officials, each phrased "more than" or "over." We plot each at its stated date: Jan. 20 from state officials via ABC 10News; Feb. 27 from the board meeting as reported by IAPP; July 10 from an agency blog post; Oct. 1 stands for "the beginning of October 2026" in the agency's FAQ post. The launch-day count of zero is assumed, not sourced. No daily or weekly series is published. Figures were retrieved Oct. 31, 2026 and rechecked Nov. 6; the agency's newsroom had no later count.

Daily rates (our calculation). Each rate is the difference between two consecutive announced floors divided by the calendar days between them, starting from zero on Jan. 1. Because both ends are minimums released on irregular dates, the rates are approximate. The rise of about 175,000 from July 10 to Aug. 25 is 500,000 minus 325,000. The Bloomberg Law figure (more than 350,000, July 31) and the governor's figure (over 475,000, Aug. 13) are not in the plotted series; the 125,000 difference between them is our subtraction of two floors from different publishers, and the governor's figure counts people who "requested" deletion rather than registrations. Board materials also cited 345,000+ active requests as of July 15, a count of requests, not people.

Population shares (our calculation). 560,000 divided by the Census Bureau's Vintage 2025 civilian population estimate for California, 39,222,235, is 1.43%. Divided by the civilian population 18 and older, 31,047,537, it is 1.80%. DROP allows a parent to file for a child, so neither share is a clean measure of adult uptake.

Penalty arithmetic (our calculation). $200 a day multiplied by 550,000 consumers is $110 million. Isaacson did not show his calculation.

Cost comparison. The 2023 figures ($1.14 million for fiscal years 2024-26, $600,000 for 2026-27 and ongoing) come from the Senate floor analysis, which notes they exclude enforcement staffing. The $6 million figure for fiscal 2026-27 is from the agency's August 2026 fee memo and covers registry administration and enforcement as well as DROP. The ratio of ten is ours and compares estimates with different scope.

Broker counts. The registry counts are unique company names in the agency's downloadable registry files (2024 file: 543 rows, 542 names; 2025 file: 543 rows, 540 names, with blank spacer rows excluded; 2026 file: 625 rows and names, page updated Oct. 30, 2026). Agency releases use other counts (581, 654, over 660) whose definitions are not stated. We did not reconcile them.

Deletion outcomes. Profile and record counts, the share of users with at least one deletion and "typical user" broker counts are agency summaries of broker-reported statuses. They are not independently verified, "typical" is undefined, and the wording changed between releases (records in August, profiles in October). Sign-ups measure use of the tool, not whether any particular person's data left any particular broker, and none of these figures measures scams, identity theft or spam, the outcomes Becker named.

Do Not Call. FTC figures count telephone numbers nationwide; DROP counts California residents. We do not chart them together.

Enforcement. We checked the agency's newsroom on Nov. 6, 2026; its latest release was dated Oct. 12, and none announced an action for failing to process DROP requests. Actions announced after Nov. 6 are not reflected here.

What comes next. The 30-day processing cycle under AB 883 and SB 923's wider deletion right both start Jan. 1, 2027; AB 883's provisions for elected officials and judges follow on July 1, 2027. Broker registration for 2027 is due Jan. 31, 2027, and the 2027 registry file will give the next count of registered brokers. Public comment on the broker-audit and DROP rulemaking was set to close in December 2026, and the first mandatory independent broker audits begin Jan. 1, 2028.

Frequently Asked Questions

What is California's DROP tool?

DROP, the Delete Request and Opt-out Platform, is a free state website run by the California Privacy Protection Agency (CalPrivacy). It launched on Jan. 1, 2026 under the Delete Act (SB 362, signed in October 2023). It lets a California resident send one deletion request to every data broker registered with the state, though a user can exclude specific brokers.

How many Californians have signed up for DROP?

CalPrivacy said more than 560,000 Californians had registered as of Oct. 12, 2026. Earlier announced figures were more than 155,000 on Jan. 20, more than 300,000 on June 2 and more than 500,000 on Aug. 25. Each is a floor announced by the agency, not an exact count.

When do data brokers have to act on DROP requests?

Starting Aug. 1, 2026, brokers must access DROP at least every 45 days to retrieve and process requests. They must report the status of each request within 45 days of retrieving it. Under AB 883, the interval becomes at least every 30 days starting Jan. 1, 2027.

What happens to a data broker that does not delete?

CalPrivacy says the fine is $200 a day per consumer for failing to delete information as required, plus the agency's investigation and enforcement costs. Failing to register carries a $200 daily penalty. Through the agency's Oct. 12, 2026 release, its announced fines were for registration failures (one also for requiring partial Social Security numbers before an opt-out), not for failing to process DROP requests.

How many data brokers are registered in California?

It depends on the count. The agency's 2026 registry file listed 625 unique brokers as of Oct. 30, 2026. Agency releases cited 581 registered brokers on June 2, 654 brokers in the DROP system on Aug. 25 and over 660 on Oct. 12. The definitions behind those figures differ and have not been reconciled.

Has DROP actually deleted anything?

By the agency's account, brokers had reported deleting close to 100 million consumer profiles by Oct. 12, 2026, and 99.9% of users had information deleted by at least one broker. These are broker self-reports compiled by the agency. Mandatory independent broker audits start Jan. 1, 2028.

How does DROP compare with the Do Not Call Registry?

The FTC said consumers registered more than 30 million phone numbers nationally, 3.4 million of them in California, in the Do Not Call Registry's first five weeks in 2003. DROP had more than 560,000 California residents a little over nine months after launch. The units differ: the FTC counted phone numbers, DROP counts people.