One request, filed once, reaches all 603 data brokers registered in California. A broker that matches you has to delete what it holds — including the non-exempt inferences it drew about you. A broker that can't match you exactly has to stop selling or sharing it instead, and some data is lawfully exempt and stays. They keep re-checking at least every 45 days for as long as the request stands. It's free, it's the state's own system, and it needs three pieces of information.
Open California's DROP portal → consumer.drop.privacy.ca.gov — the state's own portal. This page just explains what to expect.California's DELETE Act created DROP — the Delete Request and Opt-out Platform, run by the California Privacy Protection Agency. It opened to consumers on January 1, 2026.
But for the first seven months it was a request going into a queue. That changed on August 1, 2026, when brokers became obligated to actually process what's in it. Most people have no idea it happened.
603 is a live count parsed from the state's own broker registry, first on August 20, 2026 and re-checked against the same CSV on September 19, 2026 — still exactly 603. It moves as companies register.
The standard guidance is to opt out of brokers one at a time — hundreds of separate forms, each with its own process, many of which quietly re-add you. Paid services like DeleteMe and Incogni exist because doing it manually is miserable.
DROP replaces that with one request backed by a statute. And critically, the obligation isn't just to delete what they have today — brokers must keep returning to the queue, so a request filed now also catches data they acquire later.
The deletion obligation reaches inferences — the conclusions brokers drew about you, not merely the raw records they bought. That's the part that actually drives what you get shown, what you get offered, and what you get charged. CalPrivacy's wording is conditional and worth keeping: inferences are personal information "subject to deletion by data brokers who match your information in their records" — and, as below, exempt categories stay regardless.
Have these ready before you start. The whole thing is one sitting.
The test is broader than "lives in California." CalPrivacy's wording covers anyone domiciled in California, including someone outside the state for a temporary or transitory purpose. The factors it names are where your primary residence is, which state issued your driver's licence or ID, and where you're registered to vote. Our reading of that — not CalPrivacy's words — is that students, people on long work assignments and snowbirds may still qualify. Someone who genuinely moved away does not.
Name, date of birth, and ZIP code. That's the required set. Email, phone, former/maiden names, mobile ad ID, connected-TV ID and VIN are all optional — each one you add widens the net brokers can match you against, so more optional data means more thorough deletion. And you can add multiples of everything except your date of birth: every email address you've used, every phone number, every former name.
Gather all of it before you submit. CalPrivacy is explicit that "updates are allowed once every 45 days" (Cal. Civ. Code § 1798.99.86(a)(4) says the same). Submit the bare minimum and you are locked out of adding your email address for 45 days, while brokers process against a profile that can't match you. This is the one place where doing it in two sittings is worse than doing it in one.
Go to consumer.drop.privacy.ca.gov. Residency is verified through the California Identity Gateway, and it's worth being precise about what that does and doesn't keep: CalPrivacy says the information you enter to verify residency is not shared with DROP and is not stored after the check. Your deletion profile — the name, birth date and ZIP you're filing with — is stored, in a secure format. You'll get an 8-digit DROP ID — keep it private; it's how you check status later. Don't pay a third-party site to file this for you.
Brokers never see what you typed. DROP hashes it — CalPrivacy's own worked
example is that emailaddress@email.com reaches a data broker as
IokUeTFtxXZQdmjolr4Kn//apUY5a6J8sVdHyiWqqUk=, and once hashed it is
"almost impossible to turn back into the original data." Matching happens on the hashes.
Two practical notes: the portal requires JavaScript and cookies, which is worth knowing if you browse with either restricted. And you can sign in with Login.gov instead of entering your details directly — CalPrivacy suggests that option only if you already have a Login.gov account.
This is the part worth understanding: CalPrivacy describes DROP as
"ongoing – not a one-time action." There's nothing to renew. Brokers return to the
queue at least every 45 days, so a request filed today also reaches data they buy next year.
You won't get 603 confirmation emails — silence isn't failure, and brokers have up to
90 days to report how they processed a request, so a check on day three
showing 603 × Pending is the expected result, not a problem. Status is at
the status page.
No renewal, but there are reasons to come back. CalPrivacy lists them: you change your name, get a new phone number or email address, get a new device (and with it a new mobile ad ID), or buy a different car. An identifier you never added is an identifier no broker can match — and the 45-day update rule applies to those edits too. You can also narrow a request: every active and future broker is included unless you uncheck specific ones, which matters if there's a record you actually rely on.
Worth being straight about, because most coverage of privacy tools isn't.
| Limit | What it means |
|---|---|
| Not always deletion | If a broker can't verify an exact match from what you gave it, the law makes it process your request as an opt-out of sale or sharing instead. CalPrivacy's own wording for that status: "Opted-out — The data broker couldn't make an exact match based on the information you provided. For now, these data brokers still have your data, but they can no longer sell or share it." That is the strongest argument for filling in the optional fields. |
| Exempt data stays | Some records are exempt by statute and are not deleted; you'll see those marked Exempted. CalPrivacy's own examples are public records — vehicle and real-estate ownership, voter registration — along with other statutory exemptions and publicly available data. That is the core inventory of people-search sites, so expect to see it. |
| California only | The DELETE Act is state law. Other states have deletion rights of their own — filed per-company rather than through one queue, which is the real difference. Oregon's, for one, expressly reaches data a controller "obtained from another source" plus derived data. |
| Registered brokers | It reaches the 603 brokers registered with California. A company that never registered isn't in the queue — though failing to register is itself a violation. |
| Filing for others | Family situations are provided for — a parent for a child, a family member for an elderly relative. Authorised agents are provided for too: Cal. Civ. Code § 1798.99.86(b)(8) says the mechanism "shall support the ability of a consumer's authorized agents to aid in the deletion request", and (b)(9) lets the consumer or their authorized agent check status. What we have not verified is how the deployed portal exposes that — we did not file a request to find out. |
| First-party data | "Data broker" is a legal category. A company you deal with directly — your bank, your employer, a site you have an account on — isn't acting as a broker toward you. Note the nuance: some registered brokers also collect from you directly, and through DROP they must delete what they got from other sources but not what you handed them yourself. |
| Not retroactive to ads | Deleting broker data doesn't undo profiling by companies you use directly, and doesn't stop new collection going forward. |
You are handing identifying details to a state system in order to have data about you deleted. The CPPA states this information is used only to complete deletion requests and is not sold or shared, and — the part that does most of the work here — brokers receive hashes, not your details. That's the trade; it's a reasonable one, but you should make it knowingly.
There is no national equivalent, and only California has a one-request queue. But three of these are things you can do today, and the first one is the best ratio.
One thing that does not travel: authorised agents. California requires DROP to support them; Texas's authorised-agent provision appears limited to opt-out rather than deletion. "Have someone file it for you" is a California advantage, not a national one.