California Delete Act: how to use DROP to delete your data from data brokers

Who can use DROP

DROP is for California residents, and that includes people whose home is in California while they're temporarily out of state. If you live anywhere else, DROP won't accept you, and you'll need your own state's law or each broker's opt-out form.

It reaches data brokers registered with the state: companies that collect and sell information about people they have no direct relationship with. According to CalPrivacy, more than 500,000 Californians had signed up and 654 data brokers were part of DROP as of August 25, 2026. At that point about a quarter of those brokers had reported processing requests.

What happens after you submit

Brokers have to log in to DROP at least once every 45 days and process each request within 45 days of getting it. They then report a status. Because a broker can take up to 45 days to download your request and another 45 to report, CalPrivacy says it can take up to 90 days before a status shows up. From January 1, 2027, AB 883 cuts the processing window to 30 days, according to CalPrivacy.

The statuses mean different things:

• Deleted: the broker found you and deleted your data.
• Exempted: the broker kept some or all of it under an exemption (see below).
• Opted-out: CalPrivacy describes this as a broker that couldn't make an exact match, so it keeps the data but can no longer sell or share it.
• Record not found: the broker had nothing it could tie to you.
• Pending: no answer yet.

The law itself says a broker that can't verify your request must treat it as an opt-out of sale or sharing. CalPrivacy's guidance to brokers draws finer lines about records it can't match, so treat Opted-out as a partial result, not the end of it. Adding more identifiers at your next 45-day update is the practical fix.

Deletion doesn't stop after the first round. A broker that deleted your data has to delete anything new about you at least every 45 days and can't sell or share new information about you.

How fast do brokers move when they want to? Their own registry filings give a hint. Of 263 data brokers that reported deletion-request figures to the California data broker registry for 2024, 156 said they complied in full with every deletion request, and the median broker reported answering in 3 days. Those figures are self-reported by the brokers and come from before DROP existed.

What DROP won't delete

DROP isn't a delete-everything button. A broker can say no, or answer Exempted, in a few situations:

• Credit and financial data. Companies are outside the Delete Act to the extent they're covered by the Fair Credit Reporting Act (credit reports) or the Gramm-Leach-Bliley Act (banks and other financial institutions). The same goes for insurers under California's Insurance Information and Privacy Protection Act and for certain health data.
• Data kept for a purpose the law allows. Brokers don't have to delete information they reasonably need for the purposes listed in Civil Code 1798.105(d), or that is exempt under Civil Code 1798.145 or 1798.146.
• Public records and first-party data. Publicly available information isn't deleted through DROP, and neither is data held by companies you deal with directly, like your bank, your phone carrier or a store where you have an account. For those, send a CCPA request to each company.

If a broker ignores your request

Give it the full window first: up to 90 days to see a status. If a broker still hasn't acted, or you think it's ignoring the law, file a complaint with CalPrivacy through its online complaint form. The Data Broker Registry page links to the same form.

The penalties are real. A broker that fails to delete faces an administrative fine of $200 for each deletion request for each day it fails to delete, plus CalPrivacy's investigation costs (Civ. Code § 1798.99.82). From January 1, 2028, brokers also need an independent compliance audit every three years.

What DROP doesn't cover

DROP covers registered brokers for California residents, and that's a lot. It doesn't reach people-search sites that never registered, people outside California, or the search results that keep showing a profile after the source is gone, and it won't tell you if a deleted listing comes back somewhere new. That's the part Serus handles: it finds the brokers and people-search sites that list you where you live, sends the removal requests and checks for relistings. Run a free scan to see what DROP left behind.