Every other approach to data broker removal has the same shape: find the sites, file with each one, repeat. California's DELETE Act, passed as SB 362 in 2023, attacks the problem from the other end. Instead of you contacting hundreds of brokers, the state runs a platform where you file once and registered brokers are required to come to it.
If you are a California resident, this is the highest-leverage privacy action available to you. Here is what it does, what it does not do, and how it fits alongside the ordinary opt-out work.
What the law sets up
Three pieces matter:
- A mandatory registry. Data brokers doing business in California must register annually with the California Privacy Protection Agency and disclose what categories of data they handle. Failure to register carries daily penalties. The public registry is itself useful, because it names brokers you have never heard of and would never think to search.
- A centralized deletion mechanism. The agency was directed to build an accessible deletion platform, known as DROP, the Delete Request and Opt-out Platform, through which a consumer submits one verified deletion request that applies across registered brokers.
- A duty to check and comply. Registered brokers are required to access the platform on a recurring cycle, process the deletion requests they find there, and continue honoring them rather than treating deletion as a one-time event. The law also builds in periodic third-party audits of broker compliance.
Implementation is phased, with consumer access to the platform and the broker compliance duty starting on separate dates set in the statute. Because agency rulemaking can adjust operational details, check the current status and the live submission link on the California Privacy Protection Agency site at cppa.ca.gov before you file.
Who can use it
The deletion mechanism is a California consumer right, so it applies to California residents. If you live elsewhere, skip to the section below on what non-Californians can still use.
Note also what the mechanism reaches: brokers that are registered as data brokers in California. It is not a universal internet delete button. A company you have a direct relationship with, your bank, your employer, a service you signed up for, is generally not a data broker under the definition, and is handled through the ordinary CCPA deletion right instead.
How to use it, step by step
- Check the registry first. Look up the public data broker registry to see the scope of who is covered. It is a genuinely eye-opening list, and it tells you which of the sites you already know are inside the system.
- Submit the deletion request through the state platform. You will verify your identity, which is the point: an unverified mechanism would be trivially abusable to delete other people's records.
- Keep your confirmation. As with any deletion right, the record of when you filed is what makes non-compliance actionable later.
- Do the ordinary opt-outs anyway. More on why below.
- Re-check in a few months. Deletion under this law is meant to be continuing rather than one-shot, but verification is still yours to do.
What the DELETE Act does not cover
Be clear-eyed about the gaps, because they determine whether you are actually done:
- Unregistered operators. A broker that ignores the registration requirement is outside the system until enforcement catches it. The long tail of clone people-search sites is exactly where this risk lives.
- Non-broker holders of your data. Companies you transact with directly are covered by the general CCPA right to delete, not by this mechanism.
- Publicly available government records. Court filings, property deeds, and similar records remain public. The brokers can be made to stop republishing, the underlying record stays.
- Data already circulating. Breach corpora and scraped copies are outside the reach of any deletion law. That side is handled by rotating credentials and monitoring, not by removal.
For that reason, treat the state mechanism as the widest net rather than the only one, and still work the 44 site-specific opt-out guides for the sites that actually publish you today.
Your other California rights, which still matter
The CCPA and CPRA give California residents rights that apply directly to businesses, including brokers:
- The right to delete personal information a business holds about you.
- The right to opt out of the sale or sharing of your personal information, which is the mechanism behind the Do Not Sell or Share My Personal Information links you see on broker sites.
- The right to correct inaccurate personal information, which is useful when a broker profile merges you with someone else.
- The right to use an authorized agent to submit requests on your behalf.
Several existing opt-outs are built on these rights. PeekYou, for example, maintains a separate CCPA path for California residents, and most major brokers have a distinct California request flow that is faster and broader than their standard form.
If you are not in California
You are not without options:
- Vermont, Texas, and Oregon also maintain data broker registries. Even if you cannot use California's platform, the registries are a discovery tool, and the brokers listed there are frequently the same ones publishing you.
- Your own state privacy law may grant deletion and opt-out rights. The set of states with comprehensive privacy statutes has grown steadily, and brokers generally honor requests from covered residents.
- The universal opt-out signal supported by several state laws, implemented in browsers and extensions as Global Privacy Control, communicates an opt-out of sale automatically on sites that honor it.
- The ordinary opt-outs work in every state, cost nothing, and are the fastest way to clear what is live right now. Start with the data broker removal guide.
The part that does not change
Even a state-run deletion platform does not end the maintenance problem. Brokers keep ingesting new public records, and a new record about a new address or a new phone number is new data. The law contemplates ongoing compliance rather than one-time erasure precisely because the pipeline never stops.
So the plan is the same as ever: file the widest request you are entitled to, sweep the sites that list you today, and keep watching. Web Watcher runs the re-checks continuously and tells you when a name comes back.
This is a plain-language summary of how the law works in practice, not legal advice. For the current filing process and dates, check the California Privacy Protection Agency directly, and start your sweep with a free scan.