Privacy & technology · California · Sources checked September 30, 2026
California residents now have a centralized way to request deletion of personal information held by registered data brokers. The Delete Request and Opt-out Platform, known as DROP, began accepting requests in January 2026. A second milestone arrived on August 1: brokers became required to begin accessing the system and processing requests.
That makes this a useful moment to understand what the service actually does. DROP is not a button that instantly removes every mention of a person from the internet. It is a statutory request mechanism directed at a defined group of businesses, with matching procedures, legal exceptions, and ongoing obligations. The distinction explains why a resident may have submitted a request but still see a pending status. The official DROP overview warns that status updates can take up to 90 days.
What changed in August 2026
The California Delete Act required creation of an accessible deletion mechanism and established obligations for data brokers. Its statutory text effective January 1, 2026 sets out the system’s legal foundation, including the August processing milestone. The practical shift is from consumers being able to lodge requests to brokers being required to act through the platform.
The law makes the process continuing rather than a single snapshot. After a qualifying request is processed, the framework addresses newly acquired information and limits future sale or sharing, subject to statutory exceptions. A broker cannot necessarily treat a successful initial deletion as the end of its responsibilities.
This article covers California’s system and the official guidance available on September 30, 2026. It is not a claim that every U.S. resident has the same centralized right. Nor is it an assessment of whether a particular company has complied with an individual request. Those questions require their own facts and legal analysis.
What is a data broker?
In broad terms, data brokers collect and sell information about people with whom they do not have the relevant direct relationship. California’s statutory definition and exclusions are important because the everyday expression “company that has my data” is much broader than the law’s covered category.
The Delete Act’s definitions should therefore be read alongside its operative duties. A retailer holding a customer’s purchase history, a business purchasing information from elsewhere, and an entity handling records under a separate regulated framework do not automatically occupy the same position. The source of the information and the role in which a business holds it can matter.
That distinction is helpful even without knowing the entire data market. A consumer may recognize the service where information was first provided but not the intermediary that later obtained it. The centralized mechanism addresses the difficulty of identifying and approaching brokers separately. It is designed around that problem, rather than around deletion of all records everywhere.
Who can use DROP, and what does it cost?
The service is for California residents and is free to consumers. The official entry point is privacy.ca.gov/drop. The agency describes a sequence of residency verification, creation of a profile, and submission of the deletion request. A paid third-party subscription is not necessary to use the state platform.
Residency verification and the information used to match broker records serve different purposes. The first establishes eligibility. The second helps a broker determine which records concern the person making the request. Confusing those steps can make a legitimate verification question look like an unnecessary duplicate, or lead someone to assume that verification alone has submitted the deletion request.
People acting for another resident should follow the platform’s own authorization and verification requirements. Permission and eligibility should not be inferred merely from knowing another person’s details. This article does not ask readers to share identification documents, request identifiers, or other personal information with the journal.
Why the system asks for identifying information
A deletion request has to connect to the right records. Different brokers may have different identifiers, such as an email address, phone number, or device-related identifier. If a request contains information that cannot be matched, the broker may be unable to identify the relevant records even when the person believes the company knows about them.
The agency’s help page explains that not every optional identifier is required and that more information can improve matching. That is a practical tradeoff, not an instruction to disclose everything imaginable. Residents should read the official field descriptions and submit information through the actual state service, rather than through an unverified message or imitation website.
A useful way to think about matching is as a record-linking problem. Two people can share an address; one person can have several email addresses over time. The same individual can appear under different identifiers in separate systems. Those ordinary complications explain why the result is not always an immediate yes-or-no answer and why a request’s accuracy matters.
The 45-day cycle and the 90-day status window
Many descriptions of DROP mention 45 days. Others mention 90. They refer to different parts of the workflow and should not be collapsed into a promise of instant deletion. The agency’s processing instructions say brokers must download relevant requests at least once every 45 days beginning August 1. They then have a processing-and-reporting cycle, with reporting due within 45 days of download.
The consumer-facing guidance consequently says a status update can take up to 90 days. A request submitted shortly after a broker’s download can follow a different schedule from one included in that download. The presence of a pending status during the initial rollout does not, by itself, prove that the broker has ignored the request.
At the same time, a processing window is not an indefinite permission to do nothing. The statute and regulations establish duties, and the agency can evaluate compliance. The careful distinction is between what a consumer can infer from a screen at a particular moment and what evidence would be needed to establish an actual missed obligation.
For residents, preserving the request confirmation and reviewing the official status page is more informative than repeatedly assuming that a fresh request will accelerate the process. The law is designed to continue operating after the initial submission. Any updates should follow the platform’s stated process rather than a workaround based on guesswork.
Understanding the possible outcomes
The consumer guide How DROP works explains that brokers may report different outcomes. A deletion result indicates matching non-exempt information was removed. A record-not-found result means the supplied information did not produce a match; it does not necessarily establish that the company has never possessed any information about the person.
An exemption result means the broker identifies a legal basis for retaining some information. An opt-out result can arise where an identifier is associated with multiple consumers and the system cannot make the relevant individual match. The important point is that outcomes should be read according to their actual meaning, not reduced to a simplistic success-or-failure score.
These labels also describe different factual questions. Was a match found? Was the information within the deletion obligation? Was an exception involved? What action followed? Keeping those questions separate is helpful when seeking clarification and avoids turning a limited status message into a conclusion it cannot support.
What DROP does not erase
DROP does not necessarily delete information a person directly supplied to a business in a first-party relationship. The agency’s explanation of personal information and brokers distinguishes that situation from information obtained from other sources. Other privacy-request rights may be relevant, but they are not identical to the DROP process.
The same guidance identifies legal exceptions and other regulatory frameworks, including certain public records and categories governed by specialized privacy laws. A statement that “all personal information will disappear” would therefore be inaccurate. Whether a particular record is exempt depends on the relevant provisions, not simply on a business announcing that it prefers to keep it.
Deletion from a covered broker also should not be confused with removal of an original public record, a search-engine result, or a social-media post. Those may involve different record holders and different legal rules. This is a conceptual distinction about where information exists: removing one copy does not logically guarantee removal of every source or every downstream copy.
Why ongoing deletion matters
One of the more consequential features of the statutory framework is that it addresses what happens after the initial response. Subject to the law’s exceptions, brokers must continue deleting newly acquired personal information covered by a request and must not sell or share new information contrary to the continuing obligation.
This changes the practical purpose of the request. A one-time cleanup would offer limited value if the same records could simply be repurchased the next day without restriction. An ongoing mechanism tries to address that reaccumulation problem as well as the existing database.
The statute also contemplates circumstances in which a request cannot be verified and connects those circumstances to treatment of sale or sharing. Readers should consult the actual text for the applicable conditions. “Could not verify” and “free to disregard all privacy obligations” are not equivalent statements.
Privacy protection does not mean zero risk
The law requires reasonable security safeguards for the deletion mechanism. The agency describes technical protections for submitted information, including hashing used in matching. Those features help explain the architecture, but no public-service description should be read as a guarantee that a system can never fail or that a person will never encounter fraud.
Residents should use the official entry point, keep their request identifier private, and avoid sending it to strangers offering to “speed up” deletion. These are general account-safety precautions rather than special legal prerequisites. The state’s help resources provide the appropriate route for access or verification problems.
It is also useful to distinguish privacy improvement from a guaranteed visible result. A reduction in data circulation may not immediately produce fewer unwanted calls or advertisements. An unchanged inbox is not reliable proof that no deletion occurred. Conversely, a quieter inbox does not independently prove that every relevant broker complied.
What consumers can document without becoming investigators
A concise record can make later questions easier to resolve: the submission date, confirmation, the status shown for the broker in question, and any relevant communication through the official service. The goal is a factual timeline, not a speculative accusation about a company’s internal database.
For example, a resident can accurately say that a particular status appeared on a particular date. Claiming that the company is intentionally selling newly collected records requires more evidence. This distinction matters because public accusations can move beyond what the platform actually reports.
If a concern remains unresolved, the state agency’s official help and enforcement resources are the natural place to learn about available channels. The existence of statutory penalties does not mean every consumer automatically receives a payment or that submitting a request guarantees an individual legal remedy. Enforcement powers and private remedies are separate legal questions.
What to watch as the system matures
The initial rollout will test practical matters such as matching quality, understandable status reporting, and repeated processing of new information. Those are areas to watch, not findings that the platform has already succeeded or failed. This article does not infer system-wide performance from anecdotes or unverified screenshots.
The statute also includes later independent-audit obligations beginning in 2028. That date is a future stage, not a requirement already completed by every broker in September 2026. As the program develops, official updates and enforcement decisions may provide more concrete evidence about implementation than early impressions alone.
A practical action plan for your DROP status
If you have already submitted a request, the useful question is what to do next—not whether the whole system has finished. Use the following worksheet alongside the official status page. These are organizational steps, not a determination that a broker has complied with or violated the law.
| Result | Useful next step | Avoid this assumption |
|---|---|---|
| Pending | Note the submission date, the broker and the date you checked. Compare your timeline with the official processing guidance before escalating. | A pending label alone does not establish a failure or a legal violation. |
| Record not found | Review the identifying information you supplied for accuracy. Decide whether an additional identifier that genuinely belongs to you would help. | No match is not a certificate that no information about you exists anywhere. |
| Opted-out | Record this separately from deletion. Consult the official explanation if you expected deletion instead. | An opt-out result does not mean the same thing as erased records. |
| Exempted | Keep the result and any explanation visible in your account. Use the agency’s help route if the basis is unclear. | The label is not enough for this journal to decide whether an exemption was correctly applied. |
| Deleted | Keep a dated record of the result, especially if you later notice a different status. | This is a broker-level result, not confirmation that every company or public source erased your data. |
The status labels above follow CalPrivacy’s consumer explanation. The agency’s broker guidance separately describes downloading requests at least every 45 days and reporting results within 45 days of download. That sequence helps explain why a visible update can take longer than a single 45-day interval. A consumer cannot infer a broker’s actual download date from the submission date alone.
Keep a short private follow-up record
A simple note is more useful than repeatedly refreshing the page. Create one row per broker you want to follow:
- Request submitted: the date shown on your confirmation.
- Last checked: the date you viewed the result.
- Broker and result: copy the displayed name and status accurately.
- Profile changes: note what type of information you corrected and when; do not duplicate sensitive values in a spreadsheet.
- Question to resolve: for example, “Does this result reflect my corrected email address?”
- Next review: a personal reminder, not a legal deadline calculated by this website.
For an illustrative example, imagine you submitted on September 10 and checked again on September 30. Your note would show 20 elapsed days. That arithmetic is useful context, but it does not reveal when a particular broker downloaded your request or establish that a response is overdue. Avoid turning a calendar estimate into an accusation.
If your profile needs a correction
Start from the official status page and follow its profile instructions. CalPrivacy’s help page says profile updates are allowed once every 45 days. Review planned changes together rather than assuming you can revise the profile every day. Optional identifiers are not compulsory for submitting a request. Use accurate information and decide what you are comfortable providing.
If you cannot retrieve your DROP ID, use the official recovery or help route. Do not post the ID in a comment, public screenshot or discussion forum. This journal cannot look up your personal request and does not need your ID.
Make a useful help request
When an explanation is needed, describe the problem precisely: the date you submitted, the broker involved, the status shown and what you expected to understand. Distinguish “I cannot access my profile” from “I do not understand this broker’s result.” Provide personal details only through the official channel when requested. Keep a copy of your question and any response.
Continue monitoring through the official system; do not assume that submitting repeated new requests is required to keep an existing request alive. For a question about an individual legal claim, the displayed status is only one piece of information.
Frequently asked questions
Can someone outside California use this service?
DROP eligibility is tied to California residency. People elsewhere should not misstate their residence; other state laws or direct company processes may offer different rights.
Does a pending result mean the request failed?
Not necessarily. The official guidance describes processing and reporting windows that can produce delays. The relevant dates and status explanation need to be considered together.
Must every optional identifier be supplied?
No. The agency says optional identifiers are not all required, although additional accurate information may improve matching. Read the current official instructions for the fields relevant to you.
Is DROP a substitute for every other privacy request?
No. Its target is the covered data-broker ecosystem. First-party records, public sources, and exempt categories may require different analysis or different processes.
Primary sources and editorial note
Sources: California Delete Act text effective January 2026; DROP overview; consumer workflow; broker processing instructions; help resources; scope and exceptions. Checked September 30, 2026. General educational information about California law, not advice about an individual claim.
Illustrative photograph by FlyD on Unsplash, used under the Unsplash License. The image is conceptual and does not show the DROP system or an actual data breach.