The California DELETE Act: One Request to Every Registered Data Broker

Every other approach to data broker removal has the same shape: find the sites, file with each one, repeat. California's DELETE Act, passed as SB 362 in 2023, attacks the problem from the other end. Instead of you contacting hundreds of brokers, the state runs a platform where you file once and registered brokers are required to come to it.

If you are a California resident, this is one request that reaches hundreds of brokers at once. Here is what it does, what it does not do, and how it fits alongside the ordinary opt-out work.

What the law sets up

Three pieces matter:

1. A mandatory registry. Data brokers doing business in California must register annually with the California Privacy Protection Agency and disclose what categories of data they handle. Failure to register carries daily penalties. The public registry is itself useful, because it names brokers you have never heard of and would never think to search.
2. A centralized deletion mechanism. The agency was directed to build an accessible deletion platform, known as DROP, the Delete Request and Opt-out Platform, through which a consumer submits one verified deletion request that applies across registered brokers.
3. A duty to check and comply. Registered brokers are required to access the platform on a recurring cycle, process the deletion requests they find there, and continue honoring them rather than treating deletion as a one-time event. The law also builds in periodic third-party audits of broker compliance.

Where it stands (checked October 18, 2026). DROP opened to Californians on January 1, 2026 at privacy.ca.gov/drop, and it is free. The state says one request reaches more than 600 registered brokers. Since August 1, 2026, those brokers must check DROP at least once every 45 days, delete what matches, and keep deleting new matches on that cycle. The state also says a broker's result can take up to 90 days to show in DROP, and that every broker should finish its first cycle by November 2026. The agency running it, the California Privacy Protection Agency, calls itself CalPrivacy.

What CalPrivacy reports so far. On October 12, 2026, at the start of its first Delete Week, the agency said more than 560,000 Californians had registered, the number of data brokers that receive a DROP request had grown to over 660, brokers had reported deleting close to 100 million consumer profiles, and the typical user's information had been reported deleted by more than 150 brokers. Those are the agency's own figures. We found no published breakdown of how often brokers answered "Exempted", which is the result to watch for people-search listings built from public records. *(CalPrivacy, October 12, 2026, read October 18, 2026.)*

Who can use it

The deletion mechanism is a California consumer right, so it applies to California residents. DROP checks residency through the California Identity Gateway, the state's identity service, without making you create an account there. You can also file for another California resident with their permission, for example a parent for a child; you verify that person's residency. If you live elsewhere, skip to the section below on what non-Californians can still use.

Note also what the mechanism reaches: brokers that are registered as data brokers in California. It is not a universal internet delete button. A company you have a direct relationship with, your bank, your employer, a service you signed up for, is generally not a data broker under the definition, and is handled through the ordinary CCPA deletion right instead.

How to use it, step by step

1. Check the registry first. Look up the public data broker registry to see the scope of who is covered. It is a genuinely eye-opening list, and it tells you which of the sites you already know are inside the system.
2. Verify your residency at privacy.ca.gov/drop. That check is the point: an unverified mechanism would be trivially abusable to delete other people's records.
3. Enter your details. Only your name, date of birth and ZIP code are required. Past names, email addresses and phone numbers are optional but help brokers match you, and so are a mobile advertising ID, a connected TV ID or a vehicle VIN if you have them.
4. Save your 8-digit DROP ID. You need it to check your status later, and the state asks you not to share it.
5. Check your status. Each broker reports one of five results: Deleted; Exempted (the law lets it keep what it holds); Opted-out (it could not match you exactly, so it still holds your data but can no longer sell or share it); Record not found; or Pending. Adding details to your request can help with Opted-out and Record not found (the state's help page allows one update every 45 days).
6. Do the ordinary opt-outs anyway. More on why below.

What the DELETE Act does not cover

Be clear-eyed about the gaps, because they determine whether you are actually done:

• Unregistered operators. A broker that ignores the registration requirement is outside the system until enforcement catches it. The long tail of clone people-search sites is exactly where this risk lives.
• Non-broker holders of your data. Companies you transact with directly are covered by the general CCPA right to delete, not by this mechanism.
• Public records. The state's own list of data a broker may keep includes public records such as vehicle or real estate ownership and voting records, and people-search sites are built largely from records like these. A people-search listing can come back "Exempted" and stay up, so check the sites themselves.
• What you gave a broker directly. DROP makes a broker delete what it got from other sources, not what you gave it yourself (as a customer, say). That takes a separate privacy request to the broker.
• Data already circulating. Breach corpora and scraped copies are outside the reach of any deletion law. That side is handled by rotating credentials and monitoring, not by removal.

For that reason, treat the state mechanism as the widest net rather than the only one, and still work the 45 site-specific opt-out guides for the sites that actually publish you today.

Your other California rights, which still matter

The CCPA and CPRA give California residents rights that apply directly to businesses, including brokers:

• The right to delete personal information a business holds about you.
• The right to opt out of the sale or sharing of your personal information, which is the mechanism behind the Do Not Sell or Share My Personal Information links you see on broker sites.
• The right to correct inaccurate personal information, which is useful when a broker profile merges you with someone else.
• The right to use an authorized agent to submit requests on your behalf.

Several existing opt-outs are built on these rights, and most major brokers have a distinct California request flow that is faster and broader than their standard form.

If you are not in California

You are not without options:

• Vermont, Texas, and Oregon also maintain data broker registries. Even if you cannot use California's platform, the registries are a discovery tool, and the brokers listed there are frequently the same ones publishing you.
• Your own state privacy law may grant deletion and opt-out rights. The set of states with comprehensive privacy statutes has grown steadily, and brokers generally honor requests from covered residents.
• The universal opt-out signal supported by several state laws, implemented in browsers and extensions as Global Privacy Control, communicates an opt-out of sale automatically on sites that honor it.
• The ordinary opt-outs work in every state, cost nothing, and are the fastest way to clear what is live right now. Start with the data broker removal guide.

The part that does not change

Even a state-run deletion platform does not end the maintenance problem. Brokers keep ingesting new public records, and a new record about a new address or a new phone number is new data. The law contemplates ongoing compliance rather than one-time erasure precisely because the pipeline never stops.

So the plan is the same as ever: file the widest request you are entitled to, sweep the sites that list you today, and keep watching. Silver subscribers can turn on Web Watcher monitoring, which rescans the sites we read every 30 days by default and emails you when a listing comes back.

*This is a plain-language summary of how the law works in practice, not legal advice. For the current filing process and dates, check CalPrivacy at privacy.ca.gov directly, and start your sweep with a free scan.*