The California Delete Act: How to Use DROP to Delete Your Data

The California Delete Act is a state law that lets California residents ask every registered data broker to delete their personal information with a single request. The request goes through the Delete Request and Opt-out Platform (DROP), a free tool run by the California Privacy Protection Agency. Since August 1, 2026, registered brokers have had to check DROP at least every 45 days and process the deletion requests they find there.

It is the biggest shortcut available for people-search cleanup in the US, but only for Californians, and only for companies that count as data brokers. This guide explains what the law does, how to use it, and what you still have to handle yourself.

What the California Delete Act is

The Delete Act (Senate Bill 362, signed in 2023) amended California’s existing data broker registration law. Before it, Californians already had a right under the California Consumer Privacy Act to ask a business to delete their data, but they had to contact each company one at a time. With so many registered brokers, that was unrealistic for most people.

The Delete Act changed three things:

• A single deletion mechanism. It required the California Privacy Protection Agency to build one platform where residents can submit a deletion request that reaches every registered data broker. That platform is DROP.
• Ongoing deletion. After processing a request, a broker must keep deleting new information it collects about you on a recurring schedule, and must not sell or share it, unless you tell it otherwise.
• Stronger oversight. Registration moved to the Privacy Protection Agency, brokers face penalties for failing to register or failing to process requests, and the law requires regular independent audits of brokers’ compliance starting in 2028.

What counts as a data broker

This is the part people most often get wrong. Under California law, a data broker is broadly a business that knowingly collects and sells to third parties the personal information of people it has no direct relationship with.

That covers people-search sites, background check aggregators, marketing data companies and similar firms. It does not cover the businesses you deal with directly, such as your bank, your phone carrier, an online store you bought from or a social network where you have an account. For those, you use your ordinary deletion rights under the CCPA, one company at a time. A browser signal such as Global Privacy Control can also opt you out of sale and sharing on the sites you visit.

Some data is also carved out. Information regulated by certain federal laws, such as consumer reports covered by the Fair Credit Reporting Act, is handled under those laws instead. Credit bureaus’ marketing lists have their own opt-out routes, covered in our guide to the credit bureau marketing opt-out.

Who can use DROP

DROP is for California residents. The platform asks you to confirm residency before you can submit a request. If you have moved away from California, or you’ve never lived there, the Delete Act doesn’t give you this route, even if a broker based in California holds your data.

Non-residents still have options: opting out of each site directly, using Google’s removal tools for search results, and any privacy rights their own state provides. Our data broker opt-out list covers the direct route.

How to use DROP, step by step

The platform’s screens may change over time, so treat this as the general shape of the process rather than a click-by-click walkthrough.

1. Find the official platform. Go through the California Privacy Protection Agency’s website to reach DROP. Don’t use a lookalike site or a paid service that claims to be “the” Delete Act portal; the official tool is free.
2. Verify that you’re a California resident. Follow the platform’s verification step. Have your current California address ready.
3. Add your identifiers. Enter the details brokers use to match records: your full name and any other names you’ve used, date of birth, email addresses, phone numbers and addresses. Brokers can only delete what they can match, so include older emails, numbers and addresses too.
4. Submit the deletion request. One submission is shared with all registered brokers.
5. Keep your details current. If you get a new phone number or move within California, update your information so future matching still works.
6. Check back later. Brokers check the platform on a schedule and then need time to process, so results won’t appear overnight.

What happens after you submit

From August 1, 2026, each registered broker must access DROP at least every 45 days and process the deletion requests on it. Once a broker deletes your data, it must continue to delete new information about you at least every 45 days, and it may not sell or share your information, unless you ask for something different. Brokers also have to tell their service providers and contractors to delete the data.

If a broker can’t verify a request, the law generally requires it to treat the request as an opt-out of the sale or sharing of your information instead. That’s less than deletion, but it still restricts what the broker can do with your data.

What the Delete Act won’t do

DROP is a strong tool with clear edges. Knowing them saves frustration:

Situation	Covered by DROP?	What to do instead
A people-search site that is a registered broker	Yes	Submit through DROP, and opt out directly if you want faster action
A broker that hasn’t registered	Not reliably	Opt out directly, and consider reporting it to the Privacy Protection Agency
A company you have an account with	No	Use a CCPA deletion request with that company
Google or Bing search results	No	Use the search engine’s removal tools once the source page changes
News articles, court records, social media posts	No	Contact the publisher, court or platform

Two more points. Information that California law treats as publicly available, such as some government records, can be handled differently from other personal data, so don’t expect every record to disappear. And a search result can linger after a broker deletes a profile, until Google recrawls the page. You can speed that up by refreshing the outdated result, or by requesting removal of results with your contact details through Google’s Results about you tool.

A worked example

This is an illustrative scenario, not a real client. A retired teacher in Sacramento finds five people-search profiles showing her address, age and relatives. She submits a request through DROP with her current and two previous addresses, her landline and both email addresses.

While she waits for brokers’ processing cycles, she uses Results about you to request removal of the profiles from Google Search, and opts out directly on the two sites that rank highest for her name. A few months later, three profiles are gone and the other two no longer show her address. One remaining profile is on a site that doesn’t appear on the broker registry, so she opts out there and adds a note to check again in a few months.

The result is a lot less exposure for far less effort than opting out of every broker site by hand, but not zero exposure. That’s a realistic expectation to set.

Common mistakes

• Paying for access to DROP. The platform is free. Some paid removal services add value by covering unregistered sites and search results, but none is needed to use DROP itself. Our guide to whether data removal services are worth it covers that trade-off, and our roundup of the best data removal services compares the main providers.
• Entering only current details. Old records are often the ones that expose past addresses.
• Assuming Google will update instantly. The search result depends on Google recrawling the page.
• Expecting the Delete Act to reach non-brokers. Your bank, retailers and apps need separate CCPA requests.
• Stopping after one pass. Unregistered sites and scraper copies still appear. A quick search every few months catches them.

When to get help

For most Californians, DROP plus a handful of direct opt-outs covers the bulk of the problem. If your details keep resurfacing on unregistered sites, or you’re dealing with harassment or a public role that attracts attention, our personal reputation management service handles ongoing monitoring and cleanup, and tells you plainly what the law can and can’t reach.

Frequently asked questions

Is the California Delete Act the same as the CCPA?

No. The CCPA gives Californians privacy rights against covered businesses, including deletion, one company at a time. The Delete Act adds a single platform for sending a deletion request to every registered data broker at once, plus ongoing deletion duties for those brokers.

Does DROP cost anything?

No. DROP is run by the California Privacy Protection Agency and is free for California residents to use.

Can I use the Delete Act if I don't live in California?

No. DROP is for California residents. People elsewhere can still opt out of data broker sites directly and use Google’s removal tools for search results, and some states give their residents other privacy rights.

Will the Delete Act remove my information from Google?

Not directly. It requires registered brokers to delete your data. Once a broker’s page changes or disappears, you can ask Google to refresh or remove the outdated result, and you can use Results about you for results showing your contact details.

How long does it take after I submit a request?

It depends on when each broker checks the platform and how long it takes to process. Brokers must check DROP at least every 45 days, so expect results to arrive over weeks to months rather than days.