DROP Data Brokers: California DELETE Act Portal Guide
One request to delete your data from hundreds of brokers.
Last updated: July 2026
Key Dates
- January 1, 2024: DELETE Act (SB 362) took effect
- January 2026: DROP portal opened, consumers can submit deletion requests now
- August 1, 2026: Data brokers must start accessing DROP (at least every 45 days) and processing requests
What Is the DELETE Act?
The California Delete Act (SB 362), signed in October 2023, is the most significant data privacy legislation since CCPA. It creates a single, free mechanism for consumers to request deletion of their personal information from all registered data brokers at once.
Previously, opting out of data brokers meant visiting hundreds of individual websites, filling out different forms, and tracking each request separately. The DELETE Act changes this by creating a centralized portal called DROP (Data Broker Registry Opt-Out Portal).
What Is the DROP Portal?
DROP (Data Broker Registry Opt-Out Portal) is a free service operated by the California Privacy Protection Agency. When you submit a request through DROP:
- Your deletion request is sent to all registered data brokers
- Brokers must process your request within 45 days
- Brokers must delete your data and not re-collect it for one year
- You can renew your request annually to maintain protection
DELETE Act Timeline
The DELETE Act has been years in the making. Here's the full legislative timeline:
October 10, 2023, Governor Signs SB 362
Governor Gavin Newsom signs the DELETE Act (SB 362) into law, authored by Senator Josh Becker. California becomes the first state to mandate a centralized data broker deletion mechanism.
January 1, 2024, Law Takes Effect
Core provisions activate. Data brokers must register with California and begin preparing for the deletion mechanism. Registration fees fund the program.
January 31, 2025, Broker Registration Deadline
All data brokers operating in California must register with the California Privacy Protection Agency (CPPA). Over 500 brokers have registered.
January 2026, DROP Portal Opens to Consumers
The Delete Request and Opt-Out Platform (DROP) goes live at privacy.ca.gov/drop. Californians can now submit a single request to delete their data from all registered brokers.
August 1, 2026, Brokers Must Start Processing Requests
Registered data brokers must begin accessing DROP at least every 45 days to retrieve and act on the deletion requests already submitted through the portal.
January 1, 2028, Accessible Deletion Mechanism
CPPA must implement an "accessible deletion mechanism" for consumers, the portal is expected to be fully mature and widely adopted by this date.
Who Can Use DROP?
The DELETE Act applies to California residents. However, many data brokers apply deletion requests nationwide rather than maintaining separate California-only processes.
You qualify if:
- You currently reside in California, OR
- You have a California address on file with data brokers
Not in California?
At least 20 states now have comprehensive privacy laws in effect, and more are on the way. Check our State Rights Lookup to see what protections you have.
How to Use DROP (Step-by-Step)
Visit the DROP Portal
Go to privacy.ca.gov/drop, the DROP portal run by the California Privacy Protection Agency. It's free to use.
Verify Your Identity
You'll need to confirm your identity. This typically requires:
- Full legal name
- Current and previous addresses
- Email addresses associated with your data
- Possibly additional verification (varies by implementation)
Submit Your Request
Once verified, submit your deletion request. DROP will automatically send it to all registered data brokers (expected to be 500+).
Wait for Processing
Brokers have 45 days to process your request. You'll receive confirmation when complete. Some brokers may contact you to verify specific records.
Renew Annually
Brokers are prohibited from re-collecting your data for one year after deletion. Set a calendar reminder to renew your request annually for ongoing protection.
How Many Data Brokers Are Registered?
As of early 2026, over 500 data brokers have registered with the California Privacy Protection Agency. This number continues to grow as enforcement increases. Some notable categories:
500+
Registered data brokers
45 days
Maximum processing time
$200/day
Penalty for non-registration
1 year
Re-collection prohibition
The broker registry is public. Here's who's registered, by category:
People Search Sites
These brokers collect your name, address, phone, and relatives from public records and sell access. They're the most visible type of data broker. You can opt out of the major ones right now:
- Spokeo - 5 min opt-out
- Whitepages - 10 min opt-out
- BeenVerified - 5 min opt-out
- Intelius - 10 min opt-out
- MyLife - 15 min opt-out
- PeopleFinder, TruePeopleSearch, FastPeopleSearch, and dozens more
Marketing Data Companies
These brokers aggregate consumer data for advertising and marketing. They build detailed profiles used for targeted ads, junk mail, and telemarketing. Major registered brokers include Acxiom, Epsilon, LiveRamp, Oracle Data Cloud, and TransUnion (marketing division).
Background Check & Risk Assessment
Companies that aggregate criminal records, employment history, and financial data for tenant screening, employment checks, and risk assessment. Note: credit bureaus (Equifax, Experian, TransUnion) are regulated separately under the FCRA and are NOT covered by DROP.
What DROP Covers
All data brokers registered with California must participate in DROP. This includes companies that:
- People search sites: Spokeo, BeenVerified, Whitepages, etc.
- Marketing data companies: Acxiom, Epsilon, Oracle Data Cloud
- Background check aggregators: Various consumer data aggregators
- Location data brokers: Companies selling location history
What DROP Doesn't Cover
The DELETE Act specifically targets data brokers. It does NOT cover:
- Companies you have a direct relationship with: Your bank, employer, doctor
- Government records: DMV, court records, property records
- Credit bureaus: Equifax, Experian, TransUnion (covered by FCRA)
- Social media platforms: Facebook, Instagram (you have accounts there)
Other States With Data Broker Laws
California's DELETE Act is the most comprehensive, but other states are following suit. If you're not in California, you may still have options:
| State | Law | Key Feature | Status |
|---|---|---|---|
| California | DELETE Act (SB 362) | One-click deletion via DROP portal | DROP live, brokers must comply Aug 2026 |
| Vermont | Data Broker Registry (H.764) | First state broker registry, annual reporting. Vermont also enacted a full comprehensive privacy law (S.71) in June 2026 | Registry active since 2019; S.71 effective 2028 |
| Florida | Florida Digital Bill of Rights (FDBR) | Deletion and opt-out rights (narrower, applies to large platforms) | Active 2024 |
| Rhode Island | RI Data Transparency & Privacy Protection Act | Deletion and opt-out rights | Active 2026 |
| Oregon | Oregon Consumer Privacy Act | Deletion rights, data broker obligations | Active 2024 |
| Texas | Data Privacy and Security Act | Data broker registration, opt-out rights | Active 2024 |
| Connecticut | CT Data Privacy Act (CTDPA) | Deletion and opt-out rights for consumers | Active 2023 |
| Colorado | Colorado Privacy Act (CPA) | Universal opt-out mechanism required | Active 2023 |
| Virginia | VCDPA | Deletion rights, data minimization | Active 2023 |
| New Jersey | NJ Data Privacy Act | Comprehensive privacy rights, deletion requests | Active 2025 |
| Delaware | Delaware Personal Data Privacy Act | Opt-out and deletion rights | Active 2025 |
| Montana | MT Consumer Data Privacy Act | Deletion rights for consumers | Active 2024 |
| New Hampshire | NH Privacy Act | Data deletion and portability | Active 2025 |
| Iowa | Iowa Consumer Data Protection | Deletion rights (narrower scope) | Active 2025 |
| Utah | Utah Consumer Privacy Act (UCPA) | Opt-out rights, data deletion | Active 2023 |
| Indiana | IN Consumer Data Protection Act | Opt-out and deletion rights | Active 2026 |
| Tennessee | TN Information Protection Act | Deletion and opt-out rights | Active 2025 |
| Minnesota | MN Consumer Data Privacy Act | Comprehensive deletion and opt-out rights | Active 2025 |
| Maryland | MD Online Data Privacy Act | Strong deletion rights, data minimization | Active 2025 |
| Nebraska | NE Data Privacy Act | Deletion and correction rights | Active 2025 |
| Kentucky | KY Consumer Data Protection Act | Opt-out and deletion rights | Active 2026 |
| Alabama | Alabama Personal Data Protection Act | Opt-out and deletion rights | Enacted 2026, effective May 2027 |
| Louisiana | Louisiana Data Privacy Act | Opt-out and deletion rights | Enacted 2026, effective Jan 2027 |
| Oklahoma | Oklahoma Consumer Data Privacy Act | Opt-out and deletion rights | Enacted 2026, effective Jan 2027 |
At least 20 states now have a comprehensive privacy law in effect, and several more (Alabama, Louisiana, Oklahoma, and Vermont's new S.71) have been enacted and take effect through 2027-2028, per the IAPP tracker. Use our State Rights Lookup tool to check what protections apply in your state.
Speed Up Your Removal Now
DROP is live and you can submit your deletion request today, but brokers aren't required to act on it until August 1, 2026. Until then, you can manually opt out of the biggest data brokers right now for faster results. Here's a prioritized plan:
Quick Win: Remove Yourself from 5 Major Brokers in 2 Hours
- Spokeo - 5 minutes, easy
- BeenVerified - 5 minutes, easy
- Whitepages - 10 minutes, medium
- Intelius - 10 minutes, medium
- MyLife - 15 minutes, harder
These 5 brokers are the most commonly used people-search sites. Removing yourself from them covers the majority of easily-found personal data online. Use our Opt-Out Tracker to track your progress.
Penalties for Non-Compliance
The DELETE Act has teeth. Data brokers who fail to comply face:
- $200 per day for failing to register with California
- Administrative fines for not processing deletion requests
- Enforcement actions from the California Privacy Protection Agency
Frequently Asked Questions
Is DROP really free?
Yes. The DELETE Act explicitly prohibits charging consumers for using DROP. It's funded by registration fees that data brokers must pay.
Will my data come back after deletion?
Brokers are prohibited from re-collecting your data for one year after deletion. However, you should renew your request annually. New data sources may also emerge.
Can I use DROP if I moved away from California?
You need to be a California resident at the time of the request. However, many brokers apply deletions nationwide anyway. Check your current state's laws too.
How is DROP different from paid services?
Paid services like DeleteMe manually submit opt-out requests to brokers individually. DROP is a legal mandate - brokers MUST participate. However, paid services may still be useful for ongoing monitoring and non-California coverage.
What if a broker doesn't delete my data?
You can file a complaint with the California Privacy Protection Agency. They have enforcement authority and can levy fines against non-compliant brokers.
When does the DROP portal launch?
DROP launched for consumers in January 2026, you can submit a deletion request now. Registered data brokers must start accessing DROP and processing those requests by August 1, 2026. The California Privacy Protection Agency (CPPA) has been building the system since the DELETE Act took effect in January 2024.
Can I opt out of data brokers without DROP?
Yes. You can manually opt out of individual data brokers right now. Our Data Broker Opt-Out Guide has direct links and step-by-step instructions for the 12 biggest brokers. DROP makes this much easier by automating all requests into one, once brokers are required to process them starting August 2026.
What is a data broker under California law?
California defines a data broker as a business that "knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." This means companies like Spokeo, BeenVerified, and Whitepages that collect your data from public records and sell it, not companies you interact with directly.
Does DROP work for minors?
Yes. The DELETE Act includes specific protections for children's data. Parents or legal guardians can submit deletion requests on behalf of minors. Brokers face additional penalties for retaining data about children under 16.
Will other states create their own DROP portals?
It's possible. Several states are watching California's implementation closely. A federal privacy bill with similar provisions has been proposed but hasn't passed. In the meantime, at least 20 states have their own privacy laws with deletion rights, check our State Rights Lookup for your state.
Does DROP handle name changes or multiple addresses?
The DROP portal will allow you to submit multiple name variations and addresses. This is important if you've changed your name (marriage, divorce, legal name change) or moved frequently, data brokers often have records under old names and previous addresses. Submit all known variations for the most complete deletion.
How do I file a complaint if a broker ignores my DROP request?
The California Privacy Protection Agency (CPPA) handles enforcement. After August 2026, you'll be able to report non-compliant brokers directly through the DROP portal. CPPA can impose fines of $200/day for registration violations and additional administrative penalties for ignoring deletion requests. Keep records of your submission date, the 45-day clock starts then.
Is DROP better than DeleteMe or Incogni?
DROP and paid services serve different purposes. DROP is free and legally enforceable, all registered brokers must comply. Paid services like DeleteMe ($129/yr) and Incogni ($77/yr) offer ongoing monitoring, cover more brokers beyond California's registry, and handle re-removal automatically. If you're in California, use DROP first, then consider a paid service for extra coverage. Read our Paid vs DIY comparison for the full breakdown.
We'll Update This Guide
DROP is live for consumer submissions. Once data brokers are required to process requests on August 1, 2026, we'll update this guide with screenshots and any changes to the process. Bookmark this page or check back then.
While Brokers Ramp Up: Protect Your Data Now
DROP is live for submissions, but brokers don't have to act until August 1, 2026. In the meantime, a VPN prevents new data collection by hiding your IP address and encrypting your browsing activity.