California DROP: one request to every registered data broker

Last checked: 28 Sep 2026; links rechecked 12 Oct 2026

DROP (the Delete Request and Opt-out Platform) is California's free tool under the Delete Act. You make one request, and every data broker registered in California has to delete matching personal information and keep checking for new matches. It's run by CalPrivacy, the state privacy agency (formerly the CPPA).

Who can use it

California residents only. DROP verifies residency through the California Identity Gateway (optionally via Login.gov); you don't need to create a Gateway account. If verification fails, you can ask for a residency review. You can also make a request for someone else with their permission, for example a parent for a child, but their residency must be verified too.

How it works

1. Start at the DROP page and verify that you live in California.
2. Enter your details. Required: name, date of birth and ZIP code. Optional, to help brokers match more records: email addresses, phone numbers, mobile advertising IDs, connected-TV IDs and vehicle identification numbers (VINs).
3. Keep your DROP ID, an 8-digit number you use to check the status of your request.

CalPrivacy says sign-up generally takes less than 10 minutes. You can update your request once every 45 days.

What happens next

• Brokers have been required to process DROP requests since 1 August 2026. They must check DROP at least once every 45 days and delete new matching data each time, so it keeps working after the first round.
• The first response can take up to 90 days.
• Uptake: by 25 August 2026, CalPrivacy said more than 500,000 Californians had signed up, 654 brokers were on the platform, and the typical user had already had removals from 40 or more brokers.

What DROP doesn't delete

• Information you gave directly to a business (first-party data), unless a broker later bought it.
• Public records, such as vehicle or property ownership and voting records.
• Data kept for investigations, and data covered by HIPAA (health), the FCRA (credit reports) or the GLBA (financial institutions).

The DROP pages don't say how it affects people-search sites. Because public records are excluded, profiles built from them may remain, so it's still worth checking the main people-search sites.

Coming in 2027

SB 923, signed on 27 September 2026 and in force from 1 January 2027, removes the rule that information "obtained from a third party" didn't have to be deleted, and lets businesses keep suppression lists so deleted data stays deleted.

Sources

• CalPrivacy: DROP
• CalPrivacy: How DROP works
• CalPrivacy: Help with DROP
• CalPrivacy: Personal information and data brokers
• CalPrivacy: About DROP and the Delete Act
• CalPrivacy: Data brokers (obligations and penalties)
• CalPrivacy news: half a million Californians have signed up for DROP (25 Aug 2026)
• CalPrivacy news: SB 923 strengthens deletion rights (27 Sep 2026)

This page describes your options and how organisations say they handle requests. It isn't legal advice. See About & sourcing to report a correction.