If you live in California, you no longer have to opt out of data brokers one site at a time. Since January 2026 the state has run a single portal that sends one deletion request to every broker on its registry, and since August 2026 those brokers have been legally required to act on it. Here is what the Delete Act actually does, and what it still does not cover.
What the Delete Act Actually Requires
California’s Delete Act (Senate Bill 362), signed in October 2023, created a one-stop deletion mechanism for California residents to request removal from every data broker registered with the state at once, instead of submitting a separate opt-out to each site individually. The California Privacy Protection Agency (CalPrivacy) built that mechanism as the Delete Request and Opt-out Platform, known as DROP, which opened to the public on January 1, 2026 [1].
The law also pays for itself. Brokers have to register with CalPrivacy every January and pay an annual fee, and that fee funds both the public registry and DROP itself. Registering is not optional, and failing to do it is its own violation, entirely separate from whatever a broker does with your data afterwards.
How DROP Works
- You confirm you are a California resident. Verification runs through the California Identity Gateway, the state’s own digital identity service. You do not need to create an account with it, and CalPrivacy states that the information you use to verify is not retained by DROP. Signing in with Login.gov is offered as an alternative, though it is only worth using if you already have that account.
- You create a profile and choose how much to share. Brokers only need enough basic information to match you against their own records, so you decide how much to hand over. Including your mobile advertising ID improves the accuracy of that matching.
- You submit one request. DROP routes it to every broker on the state registry, which the agency currently puts at more than 600 companies.
- Brokers must delete what they hold now and what they collect later. This is the part most people miss. A registered broker is not simply clearing today’s record; it also has to delete any additional information it acquires about you going forward. That forward-looking duty is what separates DROP from a one-time opt-out that a routine re-scrape can quietly undo.
- Someone else can file on your behalf. A parent can submit for a child, and a family member can submit for an elderly relative who cannot work through the platform themselves.
Where Things Stand Now
The obligation on brokers began on August 1, 2026. From that date, every registered data broker has to check DROP at least once every 45 days, process the deletion requests waiting there, and report the status of each one back to the agency.
Expect the status shown in your own account to lag well behind that. CalPrivacy’s own guidance is that it can take up to 90 days for a status update to appear, and that the timing varies from one broker to the next. The agency’s published timeline sets November 2026 as the point by which every broker in DROP should have completed its first full download and upload cycle. So if you submitted a request earlier in the year and your dashboard still looks quiet, that is the expected behavior of a system still working through its first pass, not evidence that your request was ignored.
Enforcement Is Not Theoretical
CalPrivacy has brought more than a dozen enforcement actions against data brokers, two of them in a single week in August 2026:
- LocateSmarter LLC, an Iowa broker, was ordered to pay $116,490. It had failed to register on time, and it required Californians to hand over the last four digits of their Social Security number before it would process an opt-out. The agency treated that demand as a violation in its own right: forcing people to surrender extra sensitive data in order to exercise a privacy right both discourages them from trying and breaches the CCPA’s data minimization rules. This was the first action the agency brought against a data broker under both the CCPA and the Delete Act.
- Cybba, Inc., a Boston advertising data broker, was ordered to pay $52,400 for missing the 2025 registration deadline. The order also requires the company to publish privacy rights metrics on its own website and to process future deletion requests through DROP.
The penalty structure is what gives the August deadline weight: $200 per day for failing to register, and $200 per deletion request per day for failing to delete when required. Those numbers multiply quickly across a large request queue.
The LocateSmarter case is worth remembering even if you never touch DROP. If a broker demands your Social Security number before it will honor an opt-out, that is a warning sign rather than a normal step in the process.
What DROP Does and Doesn’t Cover
- It only reaches registered brokers. The registry is long, but a company that never registered is not in DROP at all, which is precisely why the agency keeps fining businesses for non-registration.
- It is California only. If you live elsewhere, DROP is not available to you, and you are back to individual opt-outs, a paid removal service, or whatever your own state happens to provide.
- It does not cover every company holding your data. The Delete Act targets businesses that sell information about people they have no direct relationship with. A company you signed up with yourself is handled by your ordinary CCPA rights instead.
- Deletion has side effects. CalPrivacy notes you may see fewer targeted ads and less personalized content afterwards, which most people submitting a request consider the entire point.
The Bottom Line
DROP is a genuine improvement for California residents: one request instead of hundreds, free to use, and now backed by an active enforcement program rather than a promise. It is still not instant, and it is not universal. If you are in California, submitting a request costs nothing and takes a few minutes, and it is worth checking afterwards that the listings actually came down. If you live anywhere else, or you want to reach the brokers DROP cannot, our individual opt-out guides and removal service comparison cover the alternatives.
References
- Data Broker Registry. California Privacy Protection Agency
