California Residents Empowered to Take Control: New Tool Allows Demands for Personal Data Deletion from Brokers

Since 2020, Californians have had the right to stop companies from collecting and selling their data, but the process was tedious, requiring opting out with each company individually. The Delete Act was enacted in 2023 to simplify this process, allowing residents to request that over 500 data brokers delete their information in one go.

Now, the Delete Requests and Opt-Out Platform (DROP) enables residents to make this request. Upon verification of residency, DROP users can submit a deletion request that will be sent to all current and future data brokers registered in the state.

Although not all data will be deleted immediately, brokers are expected to start processing requests in August 2026, with a 90-day window to complete the deletion process. If data is not deleted, residents can provide additional information to assist in locating their records.

Companies can retain first-party data collected from users, while only data brokers involved in buying or selling data, such as social security numbers and browsing histories, are mandated to delete it.

Certain information, like vehicle registrations and voter records sourced from public documents, is exempt from deletion. Sensitive medical data may be protected under laws like HIPAA.

The California Privacy Protection Agency believes that this tool will grant residents more control over their data, leading to a reduction in unwanted communications and lowering the risks of identity theft, fraud, AI impersonations, and data breaches.

Data brokers who do not register or fail to delete requested consumer data may face a penalty of $200 per day, along with enforcement costs, as per the agency.