Dark console-style card reading One request, every data broker. A right is not an outcome.

One Request, Every Data Broker: What California’s DROP Actually Deletes

by
Reading Time: 5 minutes

Sach batao: who holds your address, your phone number and a guess at your income, and could you ask all of them to delete it in one go?

California’s DROP, the Delete Request and Opt-out Platform, lets a California resident send one deletion request to more than 600 registered data brokers. Since 1 August 2026, those brokers have had to act on it.

🕵️ Why Data Brokers Were the Hard Part

Most privacy rights work like a complaint to a shop: you know who you dealt with, so you ask them.

A data broker breaks that. California’s Delete Act defines it as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. You never signed up. You never saw a notice. Yet your details can be in a file that someone is selling.

So the old advice, “ask the company to delete your data,” had a gap. You could not ask a company you had never heard of, and there are hundreds of them.

DROP is the state’s answer to that gap.

🧾 How Filing Works

The official page describes three steps. (California Privacy Protection Agency)

  1. Verify you are a California resident. You do this through the California Identity Gateway, with no account needed, or with Login.gov. The page says your information is not retained by DROP.
  2. Create a profile. You choose how much information to provide.
  3. Submit one request. It goes to every registered broker.

Two details are worth knowing. You can file on behalf of another California resident, such as a child or an elderly relative. And the statute says the tool must let you leave specific brokers out of a request, and change an earlier request once at least 45 days have passed.

It costs nothing, because the law says the mechanism may not charge a consumer.

📅 The Timeline Everyone Gets Wrong

The dates are easy to blur, so here they are in order.

  • 1 January 2026: the DROP regulations took effect.
  • 1 August 2026: registered brokers had to start processing what was filed.
  • November 2026: the Agency expects every broker to have completed its first download and upload cycle.
  • 1 January 2028: brokers must start undergoing an independent audit every three years.

So filing on day one did not mean deletion on day one. The DROP page itself warns that it could take up to 90 days for your status to update.

📌 Real-world case: In a statement dated 13 August 2026, the Governor’s office said more than 475,000 Californians had already asked to be deleted. That is the number of people who filed, not a count of records removed. (Office of the Governor)

Notice the verb again. A request counts people who asked. It does not count data that is gone.

⚙️ What a Broker Must Do

The statute is specific. From 1 August 2026, a registered broker must check DROP at least once every 45 days. Then, within 45 days of receiving a request, it must process it and delete the consumer’s personal information. It must also direct its service providers and contractors to delete the data they hold. (Cal. Civil Code § 1798.99.86, Agency copy)

Three parts deserve attention.

If the broker cannot verify you. It may deny a deletion, but it must then treat your request as an opt-out of the sale or sharing of your information. A failed match does not leave you with nothing.

It does not stop after one pass. After the first deletion, the broker must delete your personal information again at least every 45 days. It also may not sell or share new personal information about you, unless you ask otherwise or the law allows it. So DROP is a standing instruction, not a single sweep.

There are carve-outs. A broker need not delete data that it reasonably needs to keep for certain purposes the privacy law allows, or where deletion is not required under other exemptions. The statute adds that this retained data may not be used for marketing or any other purpose.

Seedhi baat: “delete” here means “delete what the law makes deletable.” That is a narrower promise than the button suggests.

🚧 What DROP Does Not Reach

Because DROP is built on the Delete Act’s definition of a data broker, it only reaches businesses that fit it.

The statute says that a data broker does not include entities to the extent they are covered by the federal Fair Credit Reporting Act, the Gramm-Leach-Bliley Act (financial institutions), or California’s insurance information privacy law, and it lists a health-information exclusion as well. So credit bureaus, banks and insurers are largely handled under their own rules.

And a company you have a direct relationship with is not a data broker for this purpose. Your shopping app or your bank is a different channel, so those you still have to ask yourself.

It is also a California tool: only California residents can file.

💸 The Fines: Read Them Carefully

The headline number is easy to misread, so here is what the order actually says.

The Agency’s first enforcement action against a data broker under both the CCPA and the Delete Act was announced on 11 August 2026. LocateSmarter LLC, an Iowa company, agreed to pay $116,490. That total is a $30,600 administrative fine under the Delete Act, a $79,890 fine under the CCPA, and a $6,000 annual registration fee. (Stipulated Final Order, 10 August 2026)

📌 Real-world case: The order says LocateSmarter did business as a data broker in 2025 but did not register by the 31 January 2026 deadline. It also required consumers to give part of their Social Security number to opt out, which the order treats as collecting more information than needed. Neither charge is about ignoring DROP requests. The order does go on to require the company to access DROP and process requests from now on. (same order)

So the first fine tells you the Agency will enforce the registry. It does not yet tell you how it will treat a broker that fails to delete.

For that, the statute sets the exposure: $200 for each deletion request for each day the broker fails to delete as required. (Cal. Civil Code § 1798.99.82, FindLaw copy) That is per request and per day, so it grows with every person who filed and every day that passes. I did not find any penalty announced under that clause so far.

🪙 Token Truth

A right is not an outcome.

A deletion button can count requests all day. It cannot show you that a file is really gone, only that someone promised to look. That is the same trap behind most easy-to-count numbers: the figure on the screen measures the process, not the result. (If you want that thread, start with Episode 1 of The Token Diaries.)

🇮🇳 And in India?

Toh phir, what would the Indian version look like?

Under the Digital Personal Data Protection Act, 2023, a person has the right to request erasure of personal data processed on the basis of her consent, and the Data Fiduciary must erase it unless retention is needed for the specified purpose or to comply with a law. That is section 12(3). The right is against the fiduciary the person is dealing with.

I did not find an equivalent of a single request that reaches many brokers. The consent manager framework I wrote about earlier, consent managers opening on 13 November, is about giving and withdrawing consent through one platform, which is a different job from a deletion sweep. That is my reading of the text, and I have seen no announced plan for such a thing.

✅ If You Live in California

Three checks:

  1. File once, and expect a wait. The page says status can take up to 90 days.
  2. Do not assume it covers everything. Your bank, your credit file and any company you deal with directly are outside it, so ask them separately.
  3. Look again later. Brokers must repeat the deletion every 45 days, so check your DROP status instead of filing and forgetting.

None of this is legal advice, but it is a fair reading of the text.

If you could send one request that wiped your name from every company that never asked you, would you trust that it worked, or would you want proof?

📚 References

What’s your Reaction?
+1
0
+1
0
+1
0
+1
0
+1
0
+1
0
+1
0