If you live in California, something significant is happening this August. The state is launching a free, government-run web portal where you can submit a single deletion request that reaches every registered data broker in California simultaneously — hundreds of companies that buy, sell, and resell information about you, often without your knowledge.
The portal is called DROP: the Delete Request and Opt-Out Platform. It’s the operational infrastructure behind California’s DELETE Act, signed into law in 2023 and now reaching its enforcement phase. Starting August 1, every registered data broker must process DROP requests within 45 days of submission, on a rolling cycle — meaning you can submit requests and the clock starts ticking.
This is not a minor update to existing California privacy law. It’s the most concrete, enforceable mechanism for consumer data deletion that any U.S. state has created. And it has implications well beyond California’s borders.
What Data Brokers Actually Hold
Before getting into how DROP works, it’s worth being specific about what data brokers collect — because the category is broader and more personal than most people realize.
Data brokers are companies whose primary business is aggregating personal information and selling it to other companies, advertisers, employers, landlords, insurers, and government agencies. They don’t need a direct relationship with you. They assemble profiles by purchasing data from apps you’ve used, scraping public records, buying location data from mobile advertising networks, and combining records across sources.
A typical data broker profile might include:
- Your full name, current and historical addresses, and phone numbers
- Your estimated income, credit score range, and homeownership status
- Family member names and relationships
- Employment history, inferred from public records and social profiles
- Health conditions inferred from app data and purchase history
- Location history, sometimes granular enough to identify your home, workplace, and weekly patterns
- Political affiliation, inferred from donation records and voter registration
- Photos and images scraped from public social profiles
That last item is relevant to anyone thinking about personal photo privacy. The same data brokers that aggregate your financial and location history may also hold photos scraped from public social profiles — often including face data extracted from those images. The same photos you’re concerned about on Instagram may already be in the hands of companies you’ve never interacted with.
How the DROP Platform Works
California’s CPPA (California Privacy Protection Agency) operates the DROP platform. For California residents, the process works like this:
Step 1: Identity verification. The CPPA verifies that you are who you say you are, using a secure online verification process. This is necessary to prevent people from fraudulently deleting others’ data.
Step 2: Submit your request. Once verified, your deletion request is transmitted to every data broker registered with the state. As of the platform’s launch, hundreds of brokers are registered and obligated to respond.
Step 3: Brokers have 45 days. Each registered data broker must delete your records (or flag records they believe belong to someone else) within 45 days of receiving your request. They must send a deletion confirmation to the CPPA.
Step 4: Suppression, not one-time deletion. This is the detail most people miss. The DELETE Act doesn’t just delete your current record — it suppresses future collection. If data brokers re-acquire information about you from a new source, they must delete it too, for as long as your suppression request is in effect. You don’t need to keep resubmitting; the suppression persists.
Step 5: The CPPA monitors compliance. Brokers that don’t respond or don’t comply face fines from the CPPA, which now has dedicated enforcement staff for DELETE Act violations.
What the DELETE Act Covers — and Doesn’t
The law covers “data brokers” as defined by California law: companies whose primary business is buying and selling personal information, not companies that collect data incidentally as part of a different primary service.
This means the DELETE Act applies to:
- Background check companies (Spokeo, BeenVerified, Intelius)
- People-search sites (WhitePages, Radaris, FastPeopleSearch)
- Advertising data companies that compile consumer profiles
- Insurance and financial data aggregators
- Location data companies that buy data from mobile apps
The DELETE Act does not directly apply to:
- Google, Meta, or Apple — their data collection is incidental to their primary services (search, social networking, devices), not their primary business
- Your bank or insurance company using your own data for their own products
- Companies using data they collected directly from you
The practical implication: the DROP platform is powerful for the specific category of companies that trade in personal information. It doesn’t reach the data practices of platforms like Instagram or Google directly — those are governed by the CCPA’s separate rights framework, which requires individual opt-out requests to each company rather than a single centralized submission.
Why This Matters Beyond California
California has 39 million residents and the world’s fifth-largest economy. When California creates a compliance obligation, companies that operate nationally usually find it more practical to extend that compliance broadly than to maintain separate data handling for California users.
But the DELETE Act’s effects don’t stop at California’s policy influence. Texas and Oregon both passed data broker registration requirements in 2025, with deletion-request obligations following. Vermont has had a data broker law since 2018. The DROP platform is the first state to implement the centralized deletion infrastructure that makes those laws practically enforceable rather than theoretically meaningful, and other states are watching.
Meanwhile, at the federal level, the SECURE Data Act was introduced in April of this year. If passed, it would give the FTC and the Commerce Department enforcement powers over data broker practices nationwide — not just registration requirements but actual deletion and suppression rights similar to what California’s DELETE Act provides. The existence of a working state model makes that federal legislation considerably more likely to be legislated and implemented quickly.
How to Use DROP If You’re in California
The CPPA’s DROP platform is accessible at cppa.ca.gov. You’ll need:
- A California government-issued ID or equivalent for identity verification
- Basic identifying information (current and prior addresses are helpful, since data brokers may hold records under old addresses)
- An email address for confirmation notifications
The process is designed to take under 20 minutes. The CPPA has published a help guide for users with questions about the verification process. Requests are free; there’s no fee.
For residents of other states: the existing Data Broker List maintained by the CPPA is public, and the individual brokers on it may be subject to deletion obligations in your state even without a centralized platform. The network privacy org DeleteMe and similar services have published state-by-state guides to which brokers operate opt-out mechanisms. These require individual submissions rather than a single DROP-style request, but the underlying legal rights may exist even where the infrastructure doesn’t yet.
The Gap the DELETE Act Doesn’t Close
The DELETE Act is a meaningful step. It’s also worth being precise about what it doesn’t fix.
It can’t reach data that’s already been used. If a background check company sold your information to a landlord who used it to decline your rental application last year, deleting the original record doesn’t undo that outcome. The DELETE Act prevents future sales of your data; it can’t unwind past consequences.
It doesn’t cover companies that collected your data directly. The platforms you actively use — social networks, cloud storage services, apps with their own business models — are not data brokers under this definition. Your data with those platforms is subject to CCPA’s separate individual request process, which works company-by-company rather than through a centralized portal.
Out-of-state brokers are partially covered. The California DELETE Act binds brokers that operate in California or target California consumers. A broker that operates entirely outside California with no California customers falls outside the law’s reach, though most large data brokers do have California operations.
Photos scraped from public sources may persist in AI training sets. Once facial data from a public photo has been incorporated into an AI model’s weights, a data deletion request reaches the stored record, not the model. This is a separate problem from data broker records, and one the DELETE Act doesn’t address.
The Structural Alternative
Even a maximally effective DROP submission is a cleanup effort — a response to data that was collected and sold without your direct involvement. The structural alternative is to reduce how much personal data enters these pipelines in the first place.
Services that don’t participate in data brokerage, don’t sell user data, and don’t share it with third-party advertisers or data aggregators reduce the upstream flow before it can be aggregated and resold. daftei doesn’t sell data, doesn’t show ads, and isn’t in the business of sharing user information with external parties. GDPR and CCPA compliant. Files encrypted in transit and at rest. When you delete your account, the 30-day grace window is followed by permanent, irreversible erasure of your data — not archiving, not transfer to a partner, just deletion.
The DROP platform gives California residents a meaningful way to reclaim some control after the fact. The better long-term position is to use services whose business model doesn’t create the need for that cleanup in the first place.
What to Do This August
If you’re a California resident:
- Submit a DROP request through the CPPA portal at cppa.ca.gov when the platform opens August 1.
- Audit which apps and services you use that might be contributing data to brokers. App privacy labels, introduced under California law, list what data each app collects. Apps that collect location, contacts, or browsing history are prime contributors to data broker profiles.
- Reduce your footprint going forward. Fewer public social posts, less location permission for apps, and choosing privacy-respecting services reduces what brokers can acquire about you in the first place.
- Set a reminder to revisit DROP annually. The suppression persists, but data brokers work hard to find new sources. An annual check is a reasonable maintenance cadence.
The DELETE Act is the most powerful tool California has ever given residents for controlling information that flows through the data broker ecosystem. Use it.