California Delete Act and DROP: How to Delete Your Data From Data Brokers (2026)

California's Delete Act lets a California resident ask every registered data broker to delete their personal information with one free request, through a state website called DROP (the Delete Request and Opt-out Platform). Consumers have been able to sign up since January 1, 2026, and since August 1, 2026, registered brokers must check DROP at least every 45 days and delete matching records under California Civil Code section 1798.99.86.

Information last verified on September 28, 2026.

Jurisdiction scope: This guide covers California's Delete Act (California Civil Code sections 1798.99.80 through 1798.99.89) and the California Privacy Protection Agency's DROP regulations (California Code of Regulations, title 11, sections 7600 through 7622), from a consumer's point of view. It does not cover a data broker's full compliance program, and it does not cover other states' laws except where noted. For the multistate registration picture, see our guide to US data broker registration laws.

What the Delete Act does

The Delete Act (Senate Bill 362 of 2023) built a single, state-run deletion tool on top of California's data broker registry. Instead of finding each broker and filing a separate request, a Californian files one request with the state, and every registered broker has to pull that request and act on it.

The law is aimed at a specific kind of business. Under Civil Code section 1798.99.80(c), a data broker is "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." People-search sites, marketing-list sellers, and many ad-tech data companies fit that description. A store selling to its own customers usually does not, because it has a direct relationship with them.

Definition: "'Data broker' means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." (Cal. Civ. Code § 1798.99.80(c))

The same section carves some businesses out of the definition, each only "to the extent" a federal or state regime covers them: entities covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, California's Insurance Information and Privacy Protection Act, and certain health-data processing that is exempt under Civil Code section 1798.146. That "to the extent" wording matters. A company can be a data broker for some of its data and exempt for the rest.

Every data broker must register with CalPrivacy by January 31 of each year after a year in which it acted as a broker (Civ. Code 1798.99.82(a)). The 2026 registration fee is $6,000 plus a card-processing fee of up to 2.99% (11 CCR 7600(a)). The public registry and its downloadable list live at the agency's data broker registry page. DROP is a separate consumer website.

Who can use DROP

DROP is limited to California residents. The agency's rules require it to verify your California residency before you can submit anything: "If the Agency cannot verify the consumer's residency, the consumer cannot submit a deletion request through the DROP" (11 CCR 7620(a)).

The agency's consumer pages say you count as a resident if you live in California, or if you are domiciled in California but are away for a temporary or transitory purpose. Factors it lists include your primary residence, the state that issued your driver's license or ID, and where you are registered to vote. If verification fails, you can ask for a review of your eligibility; the regulation gives you 10 calendar days from the decision to send an explanation, and the agency may ask for supporting documents.

You can also submit for someone else. The agency's pages give the examples of a parent submitting for a child and a family member submitting for an elderly relative; that person's residency still has to be verified, and you need their permission. An authorized agent, such as a paid removal service, may help only after the consumer's own residency has been verified, and the agent's full name, email address, and trade name (if it is a business) must be disclosed through the consumer's DROP account before the request is submitted (11 CCR 7621(b)). An agent cannot cancel your request unless you expressly tell it to.

If you do not live in California, DROP is not available to you. Your options are the per-broker opt-outs in our data broker opt-out directory and any deletion rights your own state's privacy law gives you.

How to submit a DROP request, step by step

The agency describes sign-up as a one-time process that generally takes less than 10 minutes, and it states that DROP is free: "we will never charge you to use DROP." The statute also bars the agency from charging consumers (Civ. Code 1798.99.86(b)(5)).

1. Go to the official site. Start at privacy.ca.gov/drop, which links to the DROP application at consumer.drop.privacy.ca.gov. The data broker registry page is a list of brokers, not the sign-up page.
2. Verify your residency. You enter basic information through the California Identity Gateway, the state's verification platform. The agency says you do not need to create a Gateway account and that DROP does not keep that information. You can instead sign in with Login.gov; the agency suggests that option only if you already have a Login.gov account.
3. Enter your identifiers. The minimum is your name, date of birth, and ZIP code. You can add more: other names (including a maiden name), email addresses, phone numbers, a mobile advertising ID, a connected-TV ID, and a vehicle identification number. The agency says you can add several of everything except your date of birth; the regulation lets you add information such as email addresses, phone numbers, and a mobile ad ID (11 CCR 7620(b)).
4. Choose which brokers to include. By default every broker active in DROP, now and in the future, is included. You can uncheck specific brokers if you want to keep a relationship with one (Civ. Code 1798.99.86(a)(3)).
5. Submit and save your DROP ID. The confirmation page shows an 8-digit DROP ID, which you can have emailed to you. You need it to check your status. The agency asks you not to share it.

Adding identifiers matters because brokers match on exact values. Under 11 CCR 7613, DROP sends brokers your identifiers in hashed form, and each broker standardizes its own records the same way (lowercase, no special characters, dates as eight digits, five-digit ZIP codes, the last ten digits of a phone number) before comparing. An old email address or a former phone number you never added cannot match anything.

Pro tip: If you use an iPhone with app tracking turned off, the agency notes there is currently no advertising identifier you can enter as a mobile ad ID. Email addresses and phone numbers are usually the more useful additions.

What happens after you submit

Brokers do not act the moment you submit. The statute sets a cycle, and the agency's own timeline shows how it plays out.

The ongoing part is what makes DROP different from a one-time opt-out. Section 1798.99.86(d)(1) requires a broker that has deleted your data to "delete all personal information of the consumer at least once every 45 days," and (d)(2) bars it from selling or sharing new personal information about you, in each case unless you request otherwise or an exemption applies.

You do not have to file again each year. The agency's guidance says DROP "is ongoing, not a one-time action" and that you do not have to resubmit a new request. If a broker finds no match today, it "must save and maintain the consumer deletion list" and compare newly collected records against it before selling or sharing them (11 CCR 7613(c)). What you can do is update your request: the regulations let you amend or cancel it no sooner than 45 calendar days after you submit (11 CCR 7620(d)). Update it when your email, phone number, or car changes.

The agency's August 25, 2026 update gives a sense of scale. It reported more than 500,000 Californians registered, 654 data brokers in the system, and about 25% of brokers already reporting processed deletion requests in the first weeks after the August 1 deadline.

What your DROP status means

Each broker reports one of a small set of results for your request, and DROP shows it to you. The labels below are the agency's; the regulation's codes are listed alongside.

"Opted-out" often appears when one identifier, such as a shared household phone number, matches more than one person. The regulations tell the broker to opt every matched person out of sale or sharing in that case rather than guess (11 CCR 7613(a)(2)(B)). A later match can change "record not found" to "record deleted" at the broker's next session.

The rules also protect you from follow-up contact: "A data broker shall not contact a consumer to verify their deletion requests submitted through the DROP" (11 CCR 7616(c)). A message claiming to be a broker asking you to confirm your DROP request is a red flag.

What DROP does not delete

DROP is powerful but narrow, and knowing its limits keeps expectations realistic. It reaches only brokers registered with California, and even those brokers can keep some data.

• Data you gave a company directly. The agency explains that if you create an account with a business and give it your email address, that business does not have to delete it because of a DROP request. The regulations exclude information a broker "collected directly from the consumer as a 'first party'" (11 CCR 7613(b)(1)(A)). You can still send that company a CCPA deletion request.
• Publicly available information. Under the California Consumer Privacy Act's definitions, which the Delete Act uses, personal information does not include "publicly available information or lawfully obtained, truthful information that is a matter of public concern" (Civ. Code 1798.140). The agency gives public records such as vehicle or real estate ownership and voting records as examples.
• Data under other federal or state regimes. A broker does not have to delete data that is exempt under Civil Code sections 1798.145 or 1798.146 (Civ. Code 1798.99.86(c)(2)(B)). That includes information handled under the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the California Financial Information Privacy Act, and HIPAA or California's medical-privacy law.
• Data needed for a listed purpose. A broker may keep data reasonably necessary for a purpose listed in Civil Code section 1798.105(d), such as security, fixing errors, or complying with a legal obligation, and may use it only for that purpose, not for marketing or any other use (Civ. Code 1798.99.86(c)(3)).
• Unregistered brokers. A company that should have registered but did not is not in DROP. That is itself a violation, and CalPrivacy has fined many brokers for it, but your request will not reach it until it registers.
• Search engine results. DROP does not remove pages from Google or other search engines. Google's Results about you tool handles search results separately.

Because of these gaps, DROP works best as the first step, not the only one. Search your own name on the largest people-search sites and use each site's own opt-out, starting with our data broker opt-out guides. A credit freeze is a separate, free protection against new-account fraud that DROP does not replace; see how to freeze your credit.

Watch out: Deleting data from brokers does not make a company stop sending mail or email it already has permission to send, and the agency says results such as less spam "will vary by consumer and may take time to notice."

What brokers must do, and the penalties

The Delete Act gives brokers three separate 45-day duties, and a separate penalty stands behind them.

• Access DROP at least every 45 days. "Beginning August 1, 2026, a data broker shall access the accessible deletion mechanism ... at least once every 45 days" (Civ. Code 1798.99.86(c)(1)).
• Process each request within 45 days of receiving it, delete the matched data, and direct its service providers and contractors to do the same (Civ. Code 1798.99.86(c)(1)(A), (C)).
• Keep deleting every 45 days and stop selling or sharing new personal information about you (Civ. Code 1798.99.86(d)).

The penalties are administrative fines in an action brought by CalPrivacy. The two most often confused figures come from different subsections of Civil Code section 1798.99.82:

Because the deletion fine runs per request and per day, a broker ignoring many requests can face large totals quickly. Enforcement must begin within five years of the violation (Civ. Code 1798.99.89). The statute provides for these agency fines; it does not give consumers a separate lawsuit under the Delete Act itself.

Two more duties add accountability over time. Beginning January 1, 2028, and every three years after that, each broker must undergo an independent third-party audit of its DROP compliance (Civ. Code 1798.99.86(e)). And by July 1 each year, a broker must publish in its privacy policy how many deletion and other privacy requests it received, complied with in whole or in part, and denied, how quickly it responded, and why it denied DROP requests (Civ. Code 1798.99.85).

Enforcement so far

CalPrivacy has been actively fining data brokers, but the published orders to date involve registration, not DROP processing. Its board decisions page lists 17 Delete Act decisions, and each one concerns a broker that failed to register or filed inaccurate registration information. As of September 28, 2026, we found no published order for failing to process DROP deletion requests; the deletion duty only began on August 1, 2026. The table shows the most recent decisions.

The newest orders go further than a fine. The LocateSmarter, Cybba, and SalesIntel orders each require the broker to access DROP and process deletion requests under section 1798.99.86 going forward. On September 3, 2026, the agency also issued Enforcement Advisory 2026-01, stating that registration information that is not "true and correct" triggers the same $200-per-day fine as failing to register, for each day the incorrect information stays in the registry. An advisory states the agency's enforcement position; it is not a new statute. For the details of two of these cases, see our coverage of the LocateSmarter and Cybba orders.

If a broker does not delete your data

Give the process time first. The agency says a status can take up to 90 days to update, and the agency expects every broker in DROP to finish its first download and upload cycle by November 2026. After that, a request stuck at "Pending," or a broker still showing your profile after reporting "Deleted," is worth reporting.

1. Document it. Note your DROP ID, the broker's name, the status DROP shows, and the date. If the broker runs a people-search site, save the address of the listing that still shows your information.
2. Use the DROP help form. The agency's DROP help page has a contact form with the reason "Data broker did not delete my data." The agency says it aims to respond in about two weeks.
3. File a complaint with CalPrivacy. The agency's complaint form is also the channel it names for reporting incorrect registration information. The agency states that it "does not represent individual consumers," and that a complaint may be used to monitor compliance or to inform an enforcement action.

For a broker that is not in DROP at all, file a direct deletion request with it under the CCPA, then follow our guide on how to file a data privacy complaint if it does not respond.

DROP and your other California privacy rights

DROP sits alongside the California Consumer Privacy Act; it does not replace it. Section 1798.99.88 says the Delete Act does not "supersede or interfere with the operation of the California Consumer Privacy Act of 2018." Under the CCPA you can still ask any covered business, including a broker, to delete your data, to stop selling or sharing it, and to limit use of sensitive information. Our guide to CCPA opt-out rights covers the "Do Not Sell or Share" right and the Global Privacy Control browser signal, which stops future sales but does not delete what a company already holds.

The individual CCPA deletion right is about to get broader. On September 27, 2026, Governor Newsom signed SB 923, which takes effect January 1, 2027. According to CalPrivacy, it closes a loophole so the right to delete reaches personal information a business obtained from third parties, not only information collected from you; the amended Civil Code section 1798.105(a) covers information collected "from or about the consumer." It also requires online-only businesses to offer an online way to submit requests, such as a webform. It amends the CCPA, not the Delete Act, so DROP itself does not change.

Other states

No other state has a working DROP-style tool yet. Connecticut's Public Act 26-64 directs its Department of Consumer Protection to build a similar "accessible deletion mechanism" by July 1, 2028, with brokers required to begin checking it and deleting on October 1, 2028. Vermont's Act 138 of 2026 orders a study of such a mechanism rather than creating one. Texas, Oregon, and Vermont run public broker registries that help you find brokers but do not delete anything for you. Our data broker registration laws guide compares those laws, and our step-by-step guide to opting out of data brokers covers the broker-by-broker route that remains the main option outside California.

This is general legal information, not legal advice. It describes California's Delete Act and the California Privacy Protection Agency's DROP rules as verified on September 28, 2026. How the law applies can depend on your specific facts. For advice about your situation, consult an attorney licensed in California.

Related guides

• Data broker opt-out guides: every major people-search site
• How to opt out of data brokers
• US data broker registration laws
• California data privacy laws
• CCPA opt-out rights
• How to submit a data deletion request

Statutes cited reflect their in-force version as of 2026-09-28.

Last updated: 2026-09-28.

Frequently Asked Questions

What is the California Delete Act?

The Delete Act is Senate Bill 362 of 2023, codified at California Civil Code sections 1798.99.80 through 1798.99.89. It requires data brokers to register with the California Privacy Protection Agency and created DROP, a free state website where a California resident can ask every registered data broker to delete their personal information with one request.

Is DROP free?

Yes. The statute bars the agency from charging consumers to use the deletion mechanism (Civil Code 1798.99.86(b)(5)), and the agency states it will never charge you to use DROP. Be cautious of any site that charges a fee to submit a DROP request for you; the official entry point is privacy.ca.gov/drop.

Can I use DROP if I do not live in California?

No. The regulations require the agency to verify California residency before a request can be submitted (11 CCR 7620(a)). Residents of other states can use each broker's own opt-out process and any deletion rights under their own state's privacy law. Connecticut's law requires a similar state tool by July 1, 2028.

How long does DROP take to delete my data?

Brokers must access DROP at least every 45 days and process a request within 45 days of receiving it (Civil Code 1798.99.86(c)). The agency says it can take up to 90 days for your status to update and expects all brokers to finish their first cycle by November 2026. After that, brokers must delete your data again at least every 45 days.

Do I need to resubmit my DROP request every year?

No. The agency says DROP is ongoing and you do not have to resubmit. A broker that finds no match must keep your request and check new data against it (11 CCR 7613(c)). You can add identifiers such as a new email or phone number, or amend your request, once every 45 days.

Does DROP remove me from people-search sites and Google?

It reaches people-search companies only if they are registered California data brokers, and brokers can keep exempt or publicly available information. DROP does not remove search engine results; Google's Results about you tool handles those. Check the largest people-search sites yourself and use their own opt-out forms as well.

What is the fine if a data broker ignores a DROP request?

Civil Code 1798.99.82(d)(1) sets an administrative fine of $200 for each deletion request for each day the broker fails to delete as required, plus the agency's reasonable costs. A separate $200-per-day fine applies to a broker that fails to register (Civil Code 1798.99.82(c)(1)).

Can someone else submit a DROP request for me?

Yes, in some cases. The agency says a parent may submit for a child and a family member for an elderly relative, with the person's residency verified and their permission. An authorized agent may help after your residency is verified, and its name and email address must be disclosed through your DROP account before the request is submitted (11 CCR 7621).