What California's DROP Actually Deletes

As of August 1, 2026, a deadline quietly passed that privacy advocates had waited nearly three years for. Every data broker registered with the state of California must now log into a government platform at least once every 45 days, download the list of residents who asked to be deleted, find those people in their databases, erase them, and report back. One request, hundreds of brokers, enforced by a state agency. It is the most consumer-friendly deletion mechanism any US state has built, and it is genuinely worth using. It also has limits that matter, and knowing them is the difference between assuming you are handled and actually being covered.

What is DROP, and what changed on August 1?

DROP stands for the Delete Request and Opt-Out Platform. It was created by California's Delete Act, signed in October 2023, and is operated by the state privacy regulator, the California Privacy Protection Agency. The platform opened to consumers on January 1, 2026, letting a California resident submit one verified request instead of contacting hundreds of companies individually. More than 300,000 Californians had signed up by this spring.

Until August 1, though, all those requests were essentially queued. Brokers were required to register, but not yet to act. That is what changed. From August 1, 2026, processing became mandatory, converting a consumer sign-up list into an enforceable obligation on the industry. If you submitted a request back in January and wondered whether anything was happening, this is the date it started.

How does the deletion actually work?

The mechanics are more clever than most people assume, because California had to solve an obvious problem: how do you tell a broker to delete someone without handing that broker a fresh list of personal information? The answer is hashing. Brokers download lists of hashed identifiers, scrambled versions of details like date of birth, email address, phone number, or mobile advertising ID. The broker applies the same scrambling process to its own records and looks for matches. A matching hash means they hold your data and must delete it.

From there, brokers must retrieve requests at least every 45 days, delete matching personal information including inferences drawn about you, report the status of each request back through the platform, and maintain suppression lists so your information is not simply re-collected and resold later. Unresolved requests must be treated, at minimum, as opt-outs. The state has enforcement teeth too: a recent amendment doubled the daily administrative fine for failing to register on the broker registry from 100 to 200 dollars per consumer, per day.

Who can use it?

California residents. That is the first and biggest boundary. DROP is a California program built on California law for Californians, and if you live in any of the other 49 states, you cannot submit a request through it. This is not a criticism of the program, it is simply the reality of privacy rights being handled state by state in the absence of a national standard. If you are a California resident, signing up is free and takes minutes, and there is no good reason not to do it.

What DROP does not delete

This is the section worth reading twice, because the headline version of this story, one click deletes everything, sets up an expectation the law never actually made. Four real gaps:

• Publicly available government records are exempt. Brokers are not required to delete information that the government makes available to the public. This matters enormously for people-search sites, whose profiles are substantially built from property deeds, voter files, court filings, and similar records. The underlying public sources keep flowing.
• Data governed by other laws is exempt, including categories covered by separate financial and health information rules. Those records sit outside the deletion obligation.
• It only reaches registered brokers. The obligation applies to companies registered with the state under the Delete Act. A site that does not meet the legal definition of a data broker, or that simply fails to register, is not going to process your request because it downloaded a list.
• Deletion depends on a match. The hashing system works by comparing identifiers. If a broker holds your information under an old address, a maiden name, a misspelling, or a different email than the one you registered, the hashes may not line up, and a record that is really yours can survive the sweep.

So is it worth using?

Yes, without hesitation, if you live in California. It is free, it is government-run, it reaches hundreds of companies with one action, and it carries penalties that individual opt-out emails never will. Nothing else available to a consumer does that. The honest framing is not that DROP is weak. It is that DROP is a powerful tool aimed at one specific target: registered brokers holding non-exempt data that matches your identifiers. That is a big and worthwhile target, and it is not the same as everything about you disappearing from the internet.

What fills the gaps?

The public-records exemption is the one that shapes everyday experience most, because it is the reason a listing can legitimately come back. A broker can honor your deletion request in full, then rebuild a profile later from a fresh property record or an updated voter file, without breaking any rule. That is the structural reason removal is a maintenance problem rather than a one-time errand, explained further in why deleting one listing is never enough and in how data brokers get your information.

What covers the remainder is the unglamorous work: checking which sites are actually publishing you right now, filing individual opt-outs with the ones DROP does not reach or did not match, and rechecking on a schedule so reappearances get caught. Whether you do that yourself or have someone do it for you, the ongoing part is what determines the result. Consumer Reports quantified the difference plainly, finding that removals done by hand or by automation cleared only about 27 percent of exposed listings, while removals handled by real people who monitor and refile reached roughly 70 percent. If you are in California, use DROP first, then treat what remains as the real job.

Frequently asked questions

Can I use DROP if I do not live in California?

No. DROP is limited to California residents under California law. Residents of other states rely on their own state privacy laws where they exist, or on the fact that many national brokers apply California-style compliance broadly when handling individual deletion and opt-out requests.

How long until my data is deleted after I submit a request?

It is a rolling cycle rather than an instant action. Brokers must check the platform at least every 45 days and report status back through the system, so allow for that cadence rather than expecting listings to vanish the day after you sign up.

Why would my listing reappear after a DROP deletion?

Most often because the information came from publicly available government records, which are exempt from the deletion requirement. A broker can delete you and later rebuild a profile from a new public filing. Suppression lists help, but the public-records pipeline continues regardless.

Does DROP replace using a removal service?

For Californians it covers a meaningful share of registered brokers at no cost, and it should be your first step. It does not reach unregistered sites, exempt categories, or records that fail to match your identifiers, so what remains still needs individual opt-outs and ongoing monitoring.