California DROP: what it deletes and what it does not

Californians now have one state tool for many data-broker deletion requests. It is called the Delete Request and Opt-out Platform, or DROP.

DROP sends one request to every active data broker in the system. You can leave some brokers out. The tool is free.

That is a useful shortcut, but it is not a magic eraser. DROP covers active data brokers and Californians. It does not clear every website, public record, or business account.

Use DROP if you are a California resident and want active data brokers to delete data matched to you. If no match is made, they must stop selling or sharing covered data.

Californians could start filing requests on January 1, 2026. Brokers began processing them on August 1, 2026.

A status update can take up to 90 days. After the first pass, brokers must check for new matching data at least every 45 days.

DROP is only for California residents. You qualify if you live in the state. You may also qualify if you are away for a short time but still based there.

The California Identity Gateway checks residency before DROP asks you to build a deletion profile. You do not need to open an Identity Gateway account.

In some cases, you can submit for another California resident. A parent may submit for a child. The other person's residency must still be checked.

If you do not live in California, DROP is not your route. Use direct broker opt-outs or any privacy tools offered by your own state.

DROP sends your deletion request to all active data brokers in its system. You may remove a broker from your request if you want that company to keep your data.

Each broker compares your profile with its own records. If it finds a match, it must delete the covered data that the law does not exempt.

The broker should delete the full matched profile. It should not stop at the detail that produced the match. This can include sensitive data and guesses built from it.

The request also stays active. Brokers must look for new matching data at least every 45 days. You do not need to file a fresh request for every cycle.

DROP does not reach every company that has your information. It is aimed at active data brokers covered by California's system.

It does not make a business delete data you gave that business. That may include an email used to open an account or join a mailing list.

DROP also does not delete public data. Property, vehicle, or voting records may remain. Other legal exceptions can let a broker keep some records.

Some health, credit, and financial data falls under other privacy laws. DROP may not control those records.

The tool does not remove a Google result, secure an exposed account, stop a card charge, or repair identity theft. Use the remedy built for that job.

You can start with details you already know. DROP accepts names, birth date, ZIP codes, email addresses, and phone numbers.

You may also add a mobile advertising ID, connected TV ID, or vehicle identification number. Those details are optional.

More data can improve a broker's chance of finding the right record. Less data means sharing fewer details through the request.

There is no single correct amount. Add details that help identify your records, and leave out optional fields you do not want to provide.

The state says DROP encrypts the data and stores it in a secure form. It uses hashing. This lets brokers compare records without seeing the original value.

Do not post or share your DROP ID. You need it to check your request status.

You can return later to update your profile. This may help after you change a name, email, phone, device, or vehicle.

The first request may not produce a quick result. Brokers started processing requests on August 1, 2026.

They have up to 90 days to report how they handled a request. The state says timing can vary by broker.

After that first pass, brokers must process new matches at least every 45 days. DROP is built as an ongoing request, not a one-day sweep.

If you filed before August 1, a pending status did not mean the request had failed. It meant broker work had not started yet.

“Record not found” is not proof that the broker has nothing about you. You may add more profile details and try to improve the match.

“Deleted” also has a limit. It covers the broker's matched, non-exempt data. It does not mean every copy of the information vanished from the internet.

Use a direct opt-out when a people-search listing is live and easy to identify. You do not need to wait for DROP to ask that site to remove a public profile.

A direct request may also help when DROP reports no match. Use one when the site sits outside the active broker list. It may also cover data that came straight from you.

The two routes can work together. DROP handles the broad, ongoing request. Direct opt-outs handle known listings that need attention now.

Keep a private log of the site, profile link, request date, and result. Check live listings again instead of treating a submitted form as proof of removal.

DROP can reduce the covered data held and sold by active brokers. It cannot make you invisible.

Data may remain in public records, business files, exempt records, and systems outside California's broker program. Search results may also show an old page for a while.

DROP is not account security or identity-theft recovery. If a password was exposed, secure the account. If someone used your identity, start with IdentityTheft.gov and the affected company.

The useful promise is narrower: one California request, sent across active brokers, with an ongoing 45-day recheck.

Is DROP available outside California?

Only California residents can submit a request.

Does DROP contact every data broker in the country?

The tool covers active data brokers in California's DROP system. It does not cover every business or website that holds your data.

Do I have to provide every optional identifier?

You choose what to provide. More details may improve matching, but identifiers such as a mobile advertising ID and VIN are optional.

Does one request keep working?

Yes. After the first processing cycle, brokers must check for new matching data at least every 45 days.

Why does my status say “record not found”?

The broker had no matching record or could not match you from the details provided. Adding more information may improve the match.

Should I stop filing direct opt-outs?

Keep using direct opt-outs for confirmed listings. They can work beside DROP, especially when a listing needs attention now.