Last updated:
21 Oct 2026 — added CalPrivacy’s 12 October figures: brokers report nearly 100 million profiles deleted.
16 Oct 2026 — added Vermont’s Act 138: tougher broker registration from 2027, but a one-request deletion system is only being studied.
🗑️ California's DROP Is Live: What Happens to Your Delete Act Request Now
The Delete Act created the first system in the world that erases you from 600+ data brokers with one request — free, for California residents — and since August 1, 2026 brokers have been legally required to act on it. Here's how to file, what you'll hear back, how the 45-day cycle works, what to do if a broker still shows your data, and what everyone else can do while the model spreads.
Key findings
DROP (the Delete Request and Opt-out Platform) lets California residents delete their data from over 600 registered data brokers with a single free request — the first system of its kind in the world, run by CalPrivacy under the 2023 Delete Act. The date that mattered has now arrived: as of August 1, 2026, data brokers must actively process deletion requests, re-checking the platform at least every 45 days. Non-compliance risks fines up to $200 per day per consumer — a figure SB 361 doubled from $100. By spring 2026, more than 300,000 Californians had already filed deletion requests (~345,000 signed up by the August go-live). Brokers never contact you: CalPrivacy verifies identity and residency and DROP handles all communication, and a broker that cannot match your data must opt you out of sale and sharing instead. It's free — the CCPA bars charging for privacy rights, so anyone charging for "DROP access" is not legitimate. Exemptions apply: data collected directly from you, public records, and information under HIPAA/FCRA/GLBA. Only California has one-request universal deletion; Vermont, Texas, and Oregon have broker registries (useful for finding brokers) but no deletion platform, and Connecticut is the first to copy the DROP model, arriving 2027. Across five state registries there are roughly 750 unique broker groups. For Californians, DROP is the free first step before any paid service; for everyone else, per-broker opt-outs remain the route until the model spreads.
For years, removing yourself from data brokers meant filing opt-out after opt-out, one company at a time, forever. California just changed that — one request now reaches over 600 brokers. This is the most significant consumer data-removal development in years, and as of August 1, 2026 it is fully in effect — registered data brokers are now legally required to process these deletion requests. The early numbers are real: more than 475,000 Californians had filed DROP requests by mid-August 2026, roughly 30% of registered brokers were processing requests in the first week (and the 2027 broker registration fee rises to $9,500), and on August 11, 2026 CalPrivacy issued its first enforcement decision against a data broker under both the CCPA and the Delete Act — fining Iowa-based LocateSmarter LLC $116,490 for registering late and demanding partial Social Security numbers to opt out, with a separate action against Cybba Inc. for failing to register at all. Here's exactly how to use it, and what to do if you're not in California.
By Ned Walsch · First published July 2026, last updated October 7, 2026 · Not legal advice
- January 1, 2026 — DROP opened to California consumers the day the Delete Act regulations took effect. TrustArc (2026)
- Spring 2026 — more than 300,000 Californians had submitted deletion requests, and roughly 345,000 had signed up by the time broker processing went live; the state later reported 475,000 by mid-August. TrustArc; FKKS, "DROP Is Now Live" (Aug 2026); Governor's office (Aug 13, 2026)
- August 1, 2026 — registered brokers must retrieve requests from DROP (CSV or API) at least every 45 days and, within 45 days of retrieving a request, delete all matching personal information including inferences, report the status in DROP, and keep a suppression list so the data stays deleted. CalPrivacy, DROP for data brokers
- Opt-out fallback — if a broker cannot locate or match your data it must opt you out of sale and sharing instead, or record a "no match"; under SB 361 (signed late 2025) a denied or unverifiable request is also treated as an opt-out within 45 days, and the registration fine doubled from $100 to $200 per day. CalPrivacy data-broker registry
- Penalty — a broker that fails to process a request faces $200 per request per day, counted from August 1, 2026 for as long as the data stays undeleted. FKKS (Aug 2026)
- Who talks to you — CalPrivacy verifies your identity and California residency, and DROP, not the broker, handles all consumer communication, so a broker contacting you directly about your DROP request is a red flag. FKKS (Aug 2026)
- August 7, 2026 — the CalPrivacy Board met to consider regulations for the DROP compliance audits that the Delete Act requires every three years from 2028. FKKS (Aug 2026)
- September 27, 2026 — AB 883 and SB 923 were signed; the 45-day cycle is set to become 30 days and the direct-collection deletion loophole closes, both from 2027 — details below.
What DROP actually is
DROP — the Delete Request and Opt-out Platform — is a free, state-run system that lets California residents delete their personal information from over 600 registered data brokers with a single request. It's administered by the California Privacy Protection Agency (CalPrivacy) under the Delete Act (SB 362, 2023), and it launched for consumers in January 2026.
The shift it represents is real. The old way to get out of the data-broker industry was to file separate opt-outs, broker by broker, hundreds of times — and then repeat it when they re-listed you. DROP replaces that with one request that reaches every registered broker at once. It is, as CalPrivacy puts it, the first platform of its kind in the world.
How it works, step by step
How do I file a DROP request, and what happens next?
Now that brokers are processing, the useful question is no longer "when does it start" but "what should I expect after I click submit". Step by step, as of October 2026:
- What you need. You must be a California resident. The portal on privacy.ca.gov walks you through identity and residency verification; CalPrivacy performs that check, not the brokers, so you never send ID documents to a data broker. It is free — the CCPA bars charging consumers to exercise privacy rights. FKKS (Aug 2026)
- Submit once and keep the confirmation. One verified request is made available to every broker on the Data Broker Registry. You do not file per broker.
- What you'll hear back. All communication about your request comes through DROP and CalPrivacy; brokers report each outcome — deleted, opted out, or no match — inside the platform, not to you by email. If a company contacts you directly "about your DROP request", treat it as suspicious. CalPrivacy, DROP for data brokers
- What to expect in the first 45–90 days. Since August 1, 2026 a broker must pull new requests from DROP at least every 45 days, then has up to 45 days from retrieval to finish. Worst case, a compliant broker that filed your request on day one of a cycle may take about 90 days to act; most should be faster. Deletion covers the personal information the broker holds about you and the inferences built from it. If your data cannot be located or matched, the broker must opt you out of sale and sharing instead. FKKS (Aug 2026)
- If a broker still shows your data after 90 days. First, check whether it is on the registry. If it is, the broker is in violation at $200 per request per day — file a complaint with CalPrivacy via privacy.ca.gov, quoting your DROP confirmation. If it is not registered, DROP never reached it: use the per-site opt-outs in our people-search removal guide, and consider reporting the unregistered broker too — CalPrivacy's August and September actions were both against brokers that registered late or not at all.
- Re-check quarterly. Brokers must keep a suppression list so your data stays deleted when fresh data arrives, but that duty only binds registered brokers — new, unregistered sites can still surface you.
Takeaway: file once, expect up to 90 days per broker, and escalate to CalPrivacy only after confirming the broker is on the registry.
DROP timeline: how did we get here, and what's next?
| When | What | Source |
|---|---|---|
| 2023 | Delete Act (SB 362) signed, ordering CalPrivacy to build a one-request deletion mechanism | CPPA |
| Nov 13, 2025 | DROP regulations approved by the Office of Administrative Law | CPPA announcement |
| Late 2025 | SB 361 signed: unverifiable requests become opt-outs; registration fine doubles to $200/day | CalPrivacy |
| Jan 1, 2026 | Regulations take effect; DROP opens to consumers | TrustArc |
| Aug 1, 2026 | Brokers must begin processing requests via CSV or API; ~345,000 consumers signed up by go-live | FKKS |
| Aug 7, 2026 | CalPrivacy Board meeting on DROP compliance-audit regulations | FKKS |
| Every 45 days | Brokers retrieve new requests; 45 days from retrieval to delete, opt out, or report no match | CalPrivacy |
| 2027 | AB 883 (45-day cycle to 30 days) and SB 923 (deletion regardless of source) take effect, per the bill texts | See below |
| 2028 | First statutory independent compliance audits of brokers, repeated every three years | FKKS |
Takeaway: the platform took three years from statute to broker obligations, and the next scheduled change is the shorter 30-day cycle in 2027.
What it can and can't delete
DROP is powerful against the commercial data-resale market, but the Delete Act carves out specific exemptions. Knowing them keeps your expectations accurate:
| DROP deletes | DROP does NOT delete (exempt) |
|---|---|
| Data brokers bought/aggregated about you without your direct involvement | Data a broker collected directly from you |
| Your profile on people-search and data-resale sites (if registered) | Publicly available government records |
| The shadowy secondary market in your personal information | Data needed for a criminal or civil investigation |
| Information under HIPAA, FCRA, or GLBA (health, credit, financial) |
In short: DROP reduces your commercial data-broker footprint — the part of your exposure you never consented to — but it doesn't erase you from public court records or your bank's files. That's a reasonable line, but it is a line.
DROP vs paid removal services: do Californians still need Optery, DeleteMe or Incogni?
This is the question that saves you money, so here's the honest version. DROP has two hard limits: it reaches only data brokers registered with California, and it is available only to California residents. Everything a paid service still does for you lives in those gaps — and in the fact that removal is maintenance, not a one-off:
- People-search sites that aren't registered. A site that has not registered with CalPrivacy never sees your DROP request. Registration is enforced — the fine doubled to $200 per day under SB 361 and the first enforcement actions in August and September 2026 targeted late or missing registrations — but an unregistered site is exactly the kind our removal guide covers with direct opt-out links.
- Out-of-state residents. If you live anywhere else, DROP cannot verify your residency and you cannot use it. The per-site route or a subscription remains the only option.
- Re-population and monitoring. Registered brokers must keep a suppression list so deleted data stays deleted, but new brokers appear and unregistered ones re-scrape. Optery, DeleteMe and Incogni keep scanning and re-filing; DROP does not send you reports or scan the open web for you. We compare the two we earn from in Optery vs DeleteMe.
Side by side:
Takeaway: for Californians DROP replaces the registered-broker part of a paid subscription, not the unregistered-site, out-of-state or monitoring parts.
The national picture: who has what
Five states now require data brokers to register. But registration and deletion are different things — and only California has the deletion part solved:
| State | Broker registry? | One-request deletion? | Notes |
|---|---|---|---|
| California | ✅ Yes (two registries) | ✅ DROP — the only one live | Delete Act; brokers processing since Aug 1, 2026 |
| Vermont | ✅ Yes (2018, the pioneer) | ❌ No | Registry is a transparency tool only; Act 138 tightens it from 2027 but only studies deletion |
| Texas | ✅ Yes (2023) | ❌ No | AG-led enforcement, settlements on record |
| Oregon | ✅ Yes (2023) | ❌ No | Broad definition, large registry |
| Connecticut | ✅ Yes (2026) | 🔜 DROP-style, from 2027 | First state to copy California's model |
Across these registries there are roughly 750 unique broker groups once you account for companies registering in multiple states. The trajectory is unmistakable: states are moving from mere registration toward California's universal-deletion model. Connecticut is the first follower; more will come. But as of 2026, California is meaningfully ahead of everyone else, and there is no federal data-broker opt-out law to fall back on.
Vermont is not next, yet. The Vermont Legislature records that the governor approved H.211, now Act 138, on 16 June 2026 Vermont Legislature: H.211 status (checked 16 Oct 2026). From 1 January 2027 the act raises the broker registration fee to $900 a year and requires each registered broker to keep a $20,000 bond Vermont Act 138 as enacted (checked 16 Oct 2026) Act 138 summary. It does not create a deletion portal. Instead, Vermont’s Secretary of State must study a free, single-request “accessible deletion mechanism”, with an interim report due by 1 December 2027 and a final report by 1 December 2028 Vermont Act 138 as enacted (checked 16 Oct 2026). Until then, Vermonters still opt out broker by broker.
Not in California? Here's your route
You can't use DROP, but you're not without options. The practical approach:
- Hit the biggest people-search sites directly. Most casual snooping and real-world harm comes from a relatively small number of large sites. Opting out of the top ten or fifteen removes you from the sources that matter most — our removal guide walks through them with direct opt-out links.
- Use the state registries to find brokers. Vermont, Oregon, and Texas publish registries so you can identify the full list of registered brokers to work through.
- Consider a paid service for the volume. Manual opt-outs are tedious and brokers re-list you, so ongoing removal is a recurring chore — a subscription service handles it across many brokers if that's more than you want to take on.
What changed in late September 2026? AB 883 moves DROP to a 30-day cycle, and SB 923 closes the deletion loophole
Three things changed in late September, and one of them is the most significant operational change to DROP since it launched.
AB 883: the 45-day cycle becomes 30
AB 883 was signed on 27 September 2026 (Chapter 507). It shortens the DROP access-and-processing cycle from every 45 days to every 30 days, and requires the Secretary of State, certain local officials, the Judicial Council and the State Bar to notify elected officials and judges that they may submit deletion requests through DROP. Bill text.
On timing, be careful. The bill text sets a 1 July 2027 operative date for the elected-official and judge notice provisions only. It states no special operative date for the 45-to-30-day change, which would therefore follow California’s default 1 January 2027 effective date — but that is an inference from the absence of a clause, not something the text says. Confirm against the chaptered statute before relying on it.
As of early October the CPPA’s own data broker page still describes the 45-day obligation and carries no notice of the change.
SB 923: deletion stops depending on where the data came from
Also signed 27 September (Chapter 482), effective 1 January 2027, the CPPA-sponsored Expanding Privacy Rights Act closes the CCPA deletion loophole: businesses must delete personal information regardless of whether it was collected directly from the consumer or obtained from a third party. It also requires online-only businesses to offer a webform for privacy requests rather than email alone, and permits suppression lists so deleted data stays deleted as fresh third-party data arrives. CalPrivacy. The suppression-list provision is the one that matters in practice — without it, deletion is a snapshot that the next data purchase undoes.
Enforcement: a fine, and a warning about the registry itself
- 1 September — the CPPA ordered SalesIntel Research, Inc. (Virginia) to pay $36,400 for failing to register with the Data Broker Registry by the 2025 deadline. The order also requires it to post privacy-rights metrics, access DROP, and process future deletion requests through it. The agency described the company as selling “more than 200 million professional contacts, 54 million mobile phone numbers.” CalPrivacy
- 3 September — Enforcement Advisory No. 2026-01, Accuracy of Data Broker Registration Information, states that unintentional errors in annual registration are violations too, at “$200 for each day the data broker fails to register as required,” and works through four scenarios on disclosing sensitive-data categories (reproductive health, citizenship, biometrics) and recipient types — including, notably, generative AI developers. Advisory (PDF)
No CPPA rulemaking is pending — the agency’s regulations page states it has no proposed packages at this time — and no other enforcement action was published in the window. On 12 October, launching its first “Delete Week”, CalPrivacy said more than 560,000 Californians are registered and that one DROP request now reaches over 660 data brokers CalPrivacy (12 Oct 2026). Its DROP FAQ (6 Oct) gives the first outcome figures: since processing began on 1 August, “99% of consumers had their information deleted by at least 1 data broker” and “70% … by 100+ data brokers”. Brokers report each request as deleted, exempt, opted-out, record not found or pending CalPrivacy DROP FAQ (6 Oct 2026). Six days later CalPrivacy gave newer figures. Brokers had reported deleting a number of consumer profiles “approaching 100 million”. A typical user had deletions reported by “more than 150 brokers”, and 99.9% by at least one. One person can have several profiles, so the 100 million is not a count of people. CalPrivacy (12 Oct 2026)
One to watch outside California: Connecticut is reported to be creating a data-broker registry from 1 January 2027 with a centralised deletion mechanism modelled on DROP, which would make it the first state to copy the design. We have not been able to verify this against the statute text and are not treating it as established.
Frequently asked questions
What is California's DROP?
DROP — the Delete Request and Opt-out Platform — is a free, state-run system that lets California residents delete their personal information from over 600 registered data brokers with a single request. It's run by the California Privacy Protection Agency (CalPrivacy) and it launched for consumers in January 2026 under the Delete Act (Senate Bill 362, passed in 2023). Instead of filing dozens or hundreds of separate opt-out requests broker by broker — the old, exhausting way — you submit one request through DROP and it reaches every registered broker at once. It is the first system of its kind in the world, and it is genuinely a major shift in how much control an ordinary person has over the data-broker industry. The consumer portal is at consumer.drop.privacy.ca.gov.
When does DROP actually start deleting my data?
It already has. Registered data brokers have been required to process DROP deletion requests since August 1, 2026. The platform opened to consumers on January 1, 2026, and the brokers' obligation to act began on that August date: they must check the platform at least every 45 days and, within 45 days of retrieving a request, delete the matching data (or opt the consumer out of sale and sharing if it cannot be matched). So if you're a California resident, a request submitted today is picked up in the broker's next 45-day retrieval cycle. Brokers that fail to comply face fines of $200 per request per day, counted from August 1, 2026 for as long as the data stays undeleted. It's still worth submitting now rather than waiting — the clock on each broker only starts once your request is in the system.
Who can use DROP — is it only for Californians?
As of 2026, DROP is only for California residents. It's built on California's Delete Act, so the deletion right it enforces applies to Californians. If you live in another state, you can't use DROP itself — but the picture is not hopeless, and it's changing. Vermont, Oregon, and Texas all have data-broker registration laws, which means those states publish registries you can use to identify which brokers hold data, even though none of them yet offers a one-request deletion platform like DROP. And the model is spreading: Connecticut became the first state to follow California's lead, enacting a DROP-style single-request deletion mechanism (its registration requirement takes effect January 1, 2027). For non-Californians right now, the practical route is still per-broker opt-outs — but the California model is clearly becoming the template other states copy.
How is DROP different from paid removal services like Optery or DeleteMe?
They solve overlapping problems in different ways, and understanding the overlap saves you money. DROP is free, government-run, and covers 600+ brokers registered in California with a single request — but only those registered brokers, only for California residents, and only on the government's timeline. Paid services like Optery and DeleteMe are subscriptions that continuously monitor and re-remove your data across a broader set of people-search sites, including some that aren't in California's registry, and they keep doing it on an ongoing basis because brokers often re-list you after a removal. The honest framing: if you're a California resident, DROP should be your first step because it's free and broad — do that before paying anyone. A paid service then makes sense if you want coverage of brokers outside the registry, ongoing re-removal without lifting a finger, or you live outside California and can't use DROP at all. Start with the free option; pay only for what it doesn't cover.
What information can DROP delete, and what's exempt?
DROP covers the personal information data brokers hold about you, but the Delete Act carves out specific exemptions, and it's worth knowing them so your expectations are accurate. Information that is generally exempt from deletion includes: data the broker collected directly from you (as opposed to buying it from elsewhere), publicly available government records, information needed to respond to a criminal or civil investigation, and data protected under other federal laws such as HIPAA (health), the FCRA (credit reporting), and GLBA (financial). In practice this means DROP is powerful against the shadowy resale market — the brokers who bought and aggregated your data without your knowledge — but it does not erase you from, say, public court records or your bank's files. That's a reasonable line, but it's a line: DROP reduces the commercial data-broker footprint, not your entire existence in records.
How do I actually submit a DROP request?
You go to the consumer portal on privacy.ca.gov and submit a deletion request, which involves verifying your identity and California residency with CalPrivacy so that brokers delete the right person's data (and so someone can't request deletion of your data maliciously). Because it's a government platform, it's free — the CCPA prohibits charging consumers to exercise privacy rights, so anyone asking you to pay for DROP access is not legitimate. Once submitted and verified, your request is made available to all registered data brokers, who have been required to process requests since August 1, 2026 and must re-check the platform at least every 45 days. CalPrivacy verifies your identity and residency and handles all communication with you; brokers do not contact you. Keep a record of your submission. And be aware that DROP handles the registered brokers automatically — for any broker not in California's registry, or if you want faster or broader coverage, per-broker opt-outs (or a paid service) remain the supplement.
Which states have data-broker laws, and are more coming?
Five states currently require data brokers to register: California (under two authorities — the Attorney General's legacy registry and the newer CalPrivacy Delete Act registry), Vermont (the pioneer, 2018), Texas, Oregon, and now Connecticut. Across these registries there are roughly 750 unique data-broker groups once you account for the heavy cross-registration (the same companies register in multiple states). But registration is not the same as deletion. Only California, through DROP, currently offers a single-request universal deletion mechanism. Vermont, Oregon, and Texas registries are transparency tools — they let you see who the brokers are — but you still have to opt out of each one individually. Vermont Act 138 of June 2026 only orders a study of a single-request deletion system, with a final report due by December 2028. Connecticut is the first to copy California's stronger model, with its DROP-style mechanism arriving as its law takes effect in 2027. The clear national trajectory is from mere registration toward California-style universal deletion, but for now California is meaningfully ahead of everyone else.
If I'm not in California, what should I do right now?
Use the state registries to identify brokers, then opt out of the significant ones directly — and consider whether a paid service is worth it for the volume. Start with the biggest people-search sites, which are where most casual snooping and a lot of harm originates: the ones this site covers in its removal guide. Each has its own opt-out process, and while it's tedious, hitting the top ten or fifteen removes you from the sources that matter most. Vermont, Oregon, and Texas publish registries that help you find the full list of registered brokers to work through. If doing it manually is more than you want to take on — and for many people it is, because brokers re-list you and it becomes a recurring chore — a subscription removal service handles the ongoing work across a wide set of brokers. The federal picture offers no help yet: there is no national data-broker opt-out law as of 2026, so the protections remain state-specific, and California's are the strongest.
Who can use DROP, and what does CalPrivacy check before a broker sees my request?
Only California residents can use DROP. When you submit, CalPrivacy verifies your identity and your California residency before the request is released to brokers; the brokers themselves never see ID documents and never contact you, because DROP handles all consumer communication. There is no fee. If you live outside California, the platform cannot verify you and you need the per-site opt-outs or a paid removal service instead; Connecticut is the first state reported to be copying the model, from 2027.
How long does DROP deletion take?
Plan on up to 90 days per broker, as of October 2026. Since August 1, 2026 each registered broker must retrieve new requests from DROP at least every 45 days and then has 45 days from retrieval to delete your matching personal information (including inferences), opt you out of sale and sharing if it cannot match you, or record a no-match, and report that outcome in DROP. A request filed on the first day of a broker's cycle can therefore take about 90 days in the worst case; many brokers act faster. AB 883, signed September 27, 2026, is set to shorten the 45-day cycle to 30 days from 2027. If a registered broker still shows your data after 90 days, it is accruing a $200-per-request-per-day penalty — check the registry at privacy.ca.gov/data-brokers and file a complaint with CalPrivacy.
Does DROP remove me from Google or people-search sites?
Not directly, and only partly. DROP sends your request to data brokers registered with California, which includes many people-search sites but not all of them; an unregistered site never receives it, and the request goes to brokers, not to search engines, so a Google result pointing at a people-search profile only disappears once the underlying site deletes the page and Google recrawls it. For unregistered people-search sites use the direct opt-out links in our removal guide, and for a result that persists after the page is gone, ask Google to refresh or remove the outdated result. Registered brokers must keep a suppression list so your data stays deleted, but new or unregistered sites can still surface you, which is where ongoing monitoring from a paid service still has a role.