This article is for informational purposes only and does not constitute legal advice. If you need legal guidance about your specific situation, consult a qualified attorney.
What CCPA and CPRA Actually Give You
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives California residents several privacy rights that apply directly to data brokers. Two matter most if you want your personal information removed:
- The right to delete. You can request that a business delete the personal information it has collected about you. This covers your name, home address, email, phone number, browsing history, purchase records, geolocation data, and more.
- The right to opt out of sale and sharing. You can direct any business to stop selling or sharing your personal information with third parties. The CCPA defines “sale” broadly, it includes renting, releasing, disclosing, or making your data available for monetary or other valuable consideration. The CPRA expanded this to also cover “sharing” for cross-context behavioral advertising.
These rights apply to businesses with more than $25 million in annual revenue, those that hold personal information on 50,000 or more people or households annually, or those that earn more than half their revenue from selling personal information. Most data brokers fall into at least one of these categories.
How to Exercise Your Rights Directly
Under the CCPA, covered businesses must offer at least two methods for you to submit deletion requests. The most common is an online form or web portal. Here is how to find it:
- Look in the company’s website footer for links labeled “Your California Privacy Rights,” “Do Not Sell or Share My Personal Information,” or “Privacy Choices.”
- Check the company’s privacy policy for instructions on submitting requests.
- Businesses must also accept requests by at least one other method, such as a toll-free phone number or a designated email address.
When submitting a request, provide the information the business needs to verify your identity and locate your records. This typically means your name, email address, and any account details. State clearly that you are exercising your right to delete personal information under the CCPA.
Once a business receives your request, it must respond within 45 days. You do not need to create an account to exercise your right to opt out of the sale of your personal information.
The DELETE Act and the DROP Platform
Contacting data brokers one at a time is tedious, especially when you may not even know which ones have your data. That is why California enacted the Delete Act (SB 362) in 2023, creating something genuinely new: a centralized deletion system.
The Delete Act required the California Privacy Protection Agency (CalPrivacy) to build the Data Broker Requests and Opt-Out Platform, known as DROP. This platform launched for consumer submissions on January 1, 2026.
How DROP Works
Using DROP is straightforward:
- Visit the official portal at privacy.ca.gov (the consumer-facing page is at consumer.drop.privacy.ca.gov).
- Verify that you are a California resident through the identity gateway or Login.gov.
- Create your profile.
- Submit your deletion request.
With that single action, your request goes out to every registered data broker in the state. CalPrivacy’s data broker registry lists the companies required to participate, and the number is significant.
DROP is a free service. CalPrivacy designed it to minimize the personal information it collects, and all submitted data is stored in an unreadable format used solely for deletion matching.
When Brokers Must Respond
Beginning August 1, 2026, data brokers are legally required to check the DROP platform at least once every 45 days and process any outstanding deletion requests. If your information matches a broker’s records, the broker must delete all associated personal data, including inferences drawn from it, unless a legal exemption applies. Requests submitted before that date are queued and will be processed once the obligation takes effect.
Importantly, the Delete Act’s scope is broader than the CCPA in one key way: it requires brokers to delete any personal information related to you, not just data collected directly from you. The obligation is also continuous. Even after a broker completes your deletion, it must keep checking and deleting any newly collected data about you at least every 45 days.
What Is a “Data Broker” Under California Law?
The Delete Act defines a data broker as any business that knowingly collects and sells personal information about a consumer with whom it does not have a direct relationship. There is no revenue threshold for this definition, so businesses that would not otherwise be covered by the CCPA may still qualify as data brokers and be required to register.
Data brokers must register annually with CalPrivacy and pay a registration fee (set at $6,000 for 2026). Those who fail to register face fines of $200 per day. CalPrivacy has already brought enforcement actions against companies that failed to register, including one order that shut down a California data broker’s operations for three years.
Limitations and Exemptions
Your rights under the CCPA and the Delete Act are not unlimited. Businesses can retain personal information when needed for security purposes, to complete a transaction you requested, for legal compliance, or for other exemptions spelled out in the CCPA. After you opt out of the sale of your personal information, a business must respect that decision for at least 12 months before it can ask you to opt back in.
What You Can Do Right Now
If you are a California resident and want to remove your data from brokers, you have two practical paths:
- Use DROP. Submit a single request through CalPrivacy’s platform and let the system distribute it to all registered data brokers. This is the most efficient approach for broad coverage.
- Contact brokers directly. If you know specific companies have your data, you can submit individual deletion requests using their privacy portals. This can be faster for a single company since the business must respond within 45 days regardless of the DROP timeline.
You can also do both. There is no limit on how many times you can submit deletion requests, and exercising your rights through one channel does not prevent you from using the other.
For more information, visit the CalPrivacy data broker registry or the California Attorney General’s CCPA page.