You can feel helpless when you don’t have control over your personal data, especially while data brokers with little concern for your privacy are making billions buying and selling hoards of consumer data collected from various sources.
The largely opaque data broker industry is worth an estimated 278 billion dollars and has been operating in the United States with little regulatory oversight until now. The responsibility of keeping data brokers’ rampant information collection in check falls predominantly on consumers themselves, and the process of submitting a deletion request isn’t always necessarily the most transparent or straightforward.
However, thanks to the California Delete Act and its newly launched Delete Request and Opt-out Platform, or DROP, California residents now have access to an online tool that can help them automatically file a data deletion request to over 500 data brokers at once. This is a major privacy win if you’re a Californian because it can help severely reduce the amount of your personal information that data brokers have at their disposal to sell and share to other third parties at their will. In turn, it also limits the risk of your personal information being exposed to cybercriminals in a data breach, sold across the dark web or used against you in a phishing attack -- all of which can lead to identity theft and other real-life harms.
Although DROP could be a game-changer for the privacy rights of Californians, it’s not a magic pill that automatically eliminates all cyber risks. At the very least, I still recommend a VPN to prevent your internet provider from monitoring your browsing habits, a password manager to ensure your login credentials remain secure and an antivirus program to keep your device safe from malware.
What is DROP?
In 2023, the California legislature passed the California Delete Act, which required the California Privacy Protection Agency, or CPPA, to “establish, by Jan. 1 2026, an accessible deletion mechanism that … allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor.”
That deletion mechanism became DROP, which went live at the beginning of the year. In addition to giving California residents an easy way to file deletion requests, DROP also requires data brokers to register annually with the CPPA, pay an annual registration fee and process deletion requests every 45 days, beginning on Aug. 1, 2026. The status of deletion requests must then be sent to the CPPA. Fines are set at $200 a day for failing to register by Jan. 31 of each year and $200 a day per consumer, plus enforcement costs, for failure to comply with the deletion request. Additionally, data brokers must undergo a third-party audit every three years, beginning on Jan. 1, 2028.
To benefit from the service, California residents need to access the DROP portal, verify their residency, create a profile and submit requests. According to the California Code of Regulations, a resident is any individual who “is in the State for other than a temporary or transitory purpose, and … every individual who is domiciled in the State who is outside the State for a temporary or transitory purpose.” In other words, if you live in California, you should be able to use DROP (even if you’re outside of the state temporarily), but if you’re just visiting California for the short term, then probably not.
When you create your profile, you can include whatever amount of personal information you’re comfortable with, including your name, address, email address, date of birth, phone number and even things like your mobile advertising ID or vehicle identification number. The CPPA advises that the more information you submit, the better the chances that data brokers will be able to match you to their records, and, therefore, delete your data. Once you’ve entered your information, you can submit your request and track its status using your unique DROP ID. You can update your deletion request at any time with additional or new information.
If a data broker detects a match based on the information you submitted with your request, all of your information held by that data broker will be deleted, except for exempted data such as publicly available data or first-party data you’ve shared directly with the company.
... continue reading