Your Data Is Out There, and California Has a Form for That

Data brokers are companies you have likely never met, holding records about you that you never handed them. California's Delete Act tries to fix the paperwork side of that problem. It does not promise to fix the rest, and the footnotes matter. This piece draws on the sources available as of early August 2026. Details may change, so check the official pages before you act.

What the Delete Act changes for consumers

The Delete Act (SB 362, 2023) requires an accessible deletion mechanism. In practice, that means one request can reach many registered data brokers instead of a separate letter to each. A data broker is a business that gathers personal information from many sources and sells it to other companies, often with no direct relationship to the person described. Privacy Rights Clearinghouse summarizes the obligations.

The 2018 California Consumer Privacy Act already gave residents deletion rights. Those rights were hard to use against brokers, which is part of why the registry and the new platform exist. The Delete Act also bars registered brokers from selling or sharing new personal information about a consumer who has submitted a request.

One limit comes first. California is one of four states, with Oregon, Texas and Vermont, that require broker registration. The tool described here is tied to California residency. It does not automatically travel with you to other states.

How DROP works, step by step

The tool is called DROP, short for Delete Request and Opt-out Platform. CalPrivacy, formerly the California Privacy Protection Agency, runs it. The agency says it is free and will never charge consumers. If anyone asks you to pay to use it, that conflicts with the official statement. The agency's DROP page is the place to check.

The process is short, which is the whole point:

1. Confirm you are a California resident. The check runs through the California Identity Gateway. You do not need a Gateway account, and DROP says it does not keep what you enter.
2. Create a profile with basic information. You choose how much to provide. You may sign in with Login.gov, though the official guidance suggests that only if you already have an account.

1. Submit one request to all registered brokers, then watch your status in DROP.
2. Wait. Brokers must check DROP at least every 45 days and process deletions within 45 days of receiving them. Status updates can take up to 90 days to appear.

The cycle repeats. A broker that re-acquires your information must delete it again on the next pass. That is a quiet but useful detail for anyone who worries about their records returning.

What deletion does and does not cover

The deletion reaches non-exempt personal information and any inferences a broker has drawn from it. Brokers must also tell their service providers and contractors to delete. Whether each broker follows through well is a separate question, and no one can promise an outcome.

Some consumers may notice fewer unwanted texts, calls and emails. Deletion may also reduce some identity theft and targeted fraud risk. It may cut targeted ads and personalized content too, which some people will like and others will miss. Results vary, and changes may take time to show up.

The sources leave real gaps. They do not say whether deletion reaches consumer reports regulated under federal law, such as those held by credit bureaus. For that, the regulation text and the CFPB are the places to start. They also do not explain how deletion affects accounts with a company you already do business with.

Exemptions, reporting, and what to watch for

Brokers may decline a request when a legal exemption applies. If they do, they must report the denial to CalPrivacy, disclose how many requests they denied, and name the specific provision they relied on. If you get a denial, that cited provision is the detail worth writing down. The sources do not list the exemptions, so judging one takes the official text or a qualified professional.

Some red flags are easy to spot. A denial with no reported provision does not match the reporting rule. A claim that deletion is finished before the 45-day window has passed does not match the stated timing. Any payment demand conflicts with the free-of-charge promise.

Brokers that fail to comply may face penalties and administrative fines. Independent audits of DROP compliance are set to begin January 1, 2028, and repeat every three years, according to IAPP. The sources do not say what an individual can do beyond those enforcement tools.

Who can use DROP and key dates

Only California residents can submit. The DROP page says a parent may submit for a child, and a family member for an elderly relative. It is not clear from the sources how the relative route works in practice, so read the DROP page and confirm that route fits your situation before starting.

CalPrivacy set August 1, 2026 as the date brokers must begin processing DROP requests, per the agency's DROP page and IAPP's reporting. Registration is annual, from January 1 to January 31, covering the prior calendar year. Registered brokers disclose the categories of personal information they collect and who they sell or share it with, and the public registry lets you read those disclosures first.

The numbers are large but fuzzy. Privacy Rights Clearinghouse reports more than 300,000 Californians had signed up by mid-2026. IAPP reports about 450,000 requests had been submitted by August 7, 2026. Broker counts range from 500 or more to over 600, depending on the date and source. Treat all of it as approximate. The proposed 2027 registration and access fee is USD 9,500, up USD 3,500 from 2026. It is a proposal, not a final figure.

Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.