On January 20, 2026, California Governor Gavin Newsom and the California Privacy Protection Agency unveiled a groundbreaking digital privacy initiative that represents the most significant expansion of consumer control over personal data in the United States. The announcement centered on the launch of the Delete Request and Opt-out Platform (DROP), a state-managed system that enables California residents to submit a single request to data brokers to delete and stop selling their personal information.
DROP is not merely another opt-out button buried in a privacy policy. It is the operational realization of the California Delete Act, a law enacted in 2023 designed to simplify and strengthen consumer rights under California’s expansive privacy regime. Advocates describe the platform as a game changer for data privacy, allowing individuals to exercise rights that were once theoretically available but practically difficult or impossible to enforce.
This article explains what DROP is, how it works, why it matters, how it intersects with existing laws, what it means for residents and businesses alike, and why other states — and possibly the federal government — are likely to watch closely.
The Context: Why California Is at the Forefront of Privacy Protection
For more than a decade, California has been a bellwether for consumer data privacy in the United States. The California Consumer Privacy Act (CCPA), first enacted in 2018 and amended over time, established legally enforceable rights for consumers to:
- know what personal data businesses collect about them,
- request deletion of that data,
- access their personal information,
- and opt out of the sale or sharing of their data.
California’s approach has been more robust than most other U.S. privacy laws, creating rights that include clear opt-out mechanisms rather than buried contractual language that few consumers ever see.
In 2020, voters approved the California Privacy Rights Act (CPRA), which expanded the scope and enforcement of the CCPA and established the California Privacy Protection Agency (CPPA) to implement and enforce privacy protections. This increase in regulatory capacity allowed California to begin responding to complex industry practices that occur outside a user’s direct interaction with a business’s website or app.
Despite these rights, one persistent challenge remained: even though consumers could opt out or request that a company delete their data, doing so across the sprawling ecosystem of data brokers was notoriously difficult. Data brokers crawl the internet, collect personal information, purchase data from third parties, and then aggregate and resell it to advertisers, list providers, lenders, and hundreds of other customers — often with little transparency and no direct interaction with the individual whose data is being traded.
Prior to DROP, a California resident who wanted to delete their data from every broker would have to identify each data broker, find its privacy request process, and submit separate requests to each one. For most consumers, that process was impossible in practice, even though the law theoretically allowed it.
The Delete Act and DROP were designed to solve this problem.
What Is DROP?
DROP stands for the Delete Request and Opt-out Platform. It is a web-based system operated by the California Privacy Protection Agency that lets a resident submit a single request to all registered data brokers in California to:
- delete personal information they have collected, and
- stop selling or sharing that personal information.
Under the rules established by the Delete Act, data brokers must register with CalPrivacy annually and must process deletion and opt-out requests submitted through DROP. This centralized mechanism is intended to make exercising privacy rights practical, efficient, and automated for individual consumers.
DROP went live on January 1, 2026, and Californians can begin submitting deletion and opt-out requests immediately. The platform verifies the user’s California residency before sending a single request on the user’s behalf to all registered data brokers.
For millions of Californians, this shift allows them to exercise meaningful control over their data in a single transaction rather than an impossible series of fragmented tasks.
How DROP Works
While the platform itself is designed to be simple for users, its underlying operation is substantial in scope. Processing a DROP request typically involves the following steps:
- Identity Verification:
Users first confirm they are California residents by verifying their identity on the DROP platform. This step is essential because the rights to delete and opt out are specific to California under current law. - Profile Setup:
After verification, users create a profile on DROP with basic contact information that data brokers can use to locate and match the consumer’s records within their systems. - Single Submission to All Brokers:
Once the profile is complete, a consumer submits one deletion request. The DROP platform then transmits this request to all registered data brokers in California’s data broker registry. - Ongoing Opt-out Cycle:
Under the Delete Act, data brokers must process DROP requests every 45 days going forward, meaning that users can update their preferences and reassert their deletion and opt-out rights periodically. - Tracking and Transparency:
Users can log into their DROP account at any time to review the status of their deletion requests and see which data brokers have acknowledged or processed the request.
From a technical perspective, DROP’s design reflects a centralized privacy signal intended to cut through the fragmentation that has historically impeded consumer control.
Why This Matters: Privacy Control, Consumer Risk, and Data Markets
Data brokers operate behind the scenes of almost every online interaction. As users browse websites, interact with mobile apps, make purchases, or even just move through physical spaces with location-enabled devices, data is collected, analyzed, and traded. That data often includes behavioral information, demographic details, purchasing history, contact information, and inferred preferences — all of which can be resold or repackaged.
Because data broker practices are often opaque, consumers typically have no idea what data exists about them, where it came from, or who might have purchased it. The economic model of data brokering is built on scale and anonymity, and existing legal frameworks allowed brokers to proliferate with minimal direct consumer engagement.
Even though the CCPA and CPRA provided opt-out rights, the practical process of exercising those rights was onerous. DROP changes that by delivering a one-stop mechanism where a consumer can:
- request deletion with a single click,
- avoid individually identifying brokers, and
- enforce rights against hundreds of companies simultaneously.
For individuals, this means:
- fewer unwanted sales of personal data,
- reduced risk of identity theft or fraud,
- fewer unsolicited contacts and marketing messages,
- more transparency about who holds their information, and
- a tangible mechanism to stop continuous resale of data without consent.
For society, DROP represents a measurable shift toward putting individuals — not corporations — in control of their personal information.
Legal Framework Behind DROP: The Delete Act
DROP was created pursuant to the California Delete Act (Senate Bill 362), signed into law in 2023 and implemented through subsequent regulations. The Delete Act expanded California’s privacy law infrastructure by:
- requiring data brokers to register annually with the state,
- mandating that brokers process deletion and opt-out requests transmitted through DROP,
- requiring brokers to disclose the categories of information they collect and share, and
- subjecting brokers to periodic audits and enforcement actions for non-compliance.
Prior to the Delete Act, data broker registration laws existed in a few states, but none provided a consumer-facing deletion and opt-out platform like DROP. California’s approach centralizes authority and places enforcement obligations on the brokers themselves.
Data brokers that fail to comply with their legal duties under the Delete Act — such as refusing or ignoring deletion requests — may face civil penalties, fines, and enforcement actions by state authorities.
The Role of the California Privacy Protection Agency (CalPrivacy)
The California Privacy Protection Agency, also known as CalPrivacy, is the state agency tasked with enforcing California privacy laws including the CCPA, CPRA, and the Delete Act. CalPrivacy’s responsibilities include:
- maintaining the official data broker registry,
- establishing and enforcing operational rules for DROP,
- auditing data brokers for compliance, and
- providing educational resources to consumers and businesses.
CalPrivacy’s involvement underscores the move from a self-regulatory model — where companies were expected to provide privacy mechanisms with little oversight — to a regulated model with official enforcement authority.
What Personal Information Is Affected
The scope of personal information that data brokers collect and trade includes a wide array of identifiers and behaviors, such as:
- names, email addresses, phone numbers, and postal addresses,
- online identifiers and device IDs,
- demographic details such as age, gender, and estimated income,
- browsing history, app usage patterns, and purchase data,
- location history, and
- inferred interests used in advertising targeting.
Under the Delete Act and DROP, when a consumer submits a request, data brokers are instructed to delete all personal information they have collected about that consumer and to stop selling or sharing new personal information.
It’s important to note that there are exceptions: first-party data collected directly by a company from its customers may not be covered under the DROP mechanism unless that company also functions as a data broker. Likewise, publicly available information — such as property records — is not subject to deletion under DROP.
Nonetheless, the categories and volume of data affected by DROP represent a significant portion of the information routinely used in online advertising, lead generation, credit risk assessment, and other commercial activities.
What Happens Next: Implementation and Enforcement
Although DROP went live on January 1, 2026, data brokers are not required to begin processing deletion and opt-out requests until August 1, 2026. This lead time gives brokers the opportunity to update internal systems, verify compliance requirements, and build mechanisms to receive and act upon DROP submissions.
Once a broker receives a DROP submission and matches the request to a consumer’s records, it must:
- delete personal information within a prescribed time frame,
- refrain from selling or sharing the data going forward, and
- report compliance and categories of data collected to CalPrivacy.
After August 1, 2026, brokers must repeat processing DELETE requests every 45 days, meaning the requirement for ongoing engagement is continuous.
Failure to comply can result in enforcement actions by the state, including fines and audits. The enforcement regime is intended to ensure brokers cannot ignore or sidestep their obligations.
Early Adoption: Public Response and Uptake
Even before brokers begin processing requests, thousands of Californians have already signed up for the DROP platform. Outreach campaigns from state authorities have encouraged residents to take advantage of the new system, describing it as a rare opportunity for individuals to take back control of their personal data.
Because the platform covers hundreds of registered brokers, consumers who submit a DROP request are effectively transmitting their deletion or opt-out instructions to a broad swath of the data economy.
This early adoption reflects both public appetite for data control and increasing awareness that personal information is a valuable commodity that most consumers have had little effective say over — until now.
Practical Implications for Consumers
For California residents, DROP offers several practical benefits:
- Centralized control:
Rather than submitting individual deletion requests, consumers can send one request that covers all registered brokers. - Reduced risk of targeted data misuse:
Limiting how brokers can sell or share data may reduce the risk of identity theft, unsolicited marketing, fraud, and intrusive profiling. - Visibility and transparency:
The platform gives consumers a dashboard where they can track the progress of deletion requests. - Periodic renewal:
By requiring brokers to process requests every 45 days, the system ensures ongoing privacy engagement rather than one-time deletion. - Accessible to all residents:
All California residents who can verify their residency can participate.
However, DROP will not eliminate all personal data exposure. Some data brokers may operate without registration or outside the scope of California’s definitions. Moreover, first-party data collected directly by companies (e.g., a retailer or bank) is not deleted via DROP unless those entities also qualify as data brokers under law.
Impacts on Businesses and Data Brokers
For businesses that qualify as data brokers under California law — typically those that collect, buy, sell, or share the personal information of large numbers of consumers — DROP represents a new compliance obligation, not a best practice.
These entities must:
- register annually with CalPrivacy,
- build mechanisms to receive automated or batch deletion/opt-out requests,
- implement internal processes to locate and delete matching records, and
- track and report compliance to regulators.
Some brokers will need to revise internal data retention policies, enhance identity matching systems, and build reporting infrastructure. This is especially true for businesses that have historically treated data sales as a core revenue stream.
For other companies that are not data brokers (for example, those that collect data solely for first-party use and do not resell it), DROP may have limited direct effect. However, the increased regulatory emphasis on data governance and consumer rights is likely to influence business practices more broadly.
National and Global Significance
California has long been a trendsetter in U.S. privacy law. The implementation of DROP — a first-of-its-kind centralized deletion and opt-out mechanism — may influence other states and potentially federal policy.
Privacy advocates argue that DROP’s model could become a blueprint for broader consumer data control frameworks. Other states have already introduced data broker registration laws, and similar deletion and opt-out mechanisms are increasingly part of the legislative agenda.
Internationally, privacy frameworks like the European Union’s GDPR and a patchwork of national laws also provide deletion and opt-out rights. DROP’s centralized mechanism could serve as a complement to existing global privacy standards, offering a scalable model for balancing consumer rights with regulatory oversight.
Potential Criticisms and Challenges
While DROP is widely hailed as a breakthrough, it is not without challenges:
- Verification hurdles:
Verifying a user’s identity to match records across dozens or hundreds of data brokers is complex and may result in incomplete deletions if identity matching fails. - Scope limitations:
Not all personal information is covered; publicly available data and certain first-party data are excluded. - Enforcement complexity:
Policing hundreds of brokers and ensuring compliance is resource-intensive. - Unknown effects on personalized services:
Some consumers may experience changes in how digital ads or recommendations are served when their data is deleted.
Even so, these challenges do not diminish the fundamental shift represented by giving individuals a single control point for personal data deletion and opt-out.
The Future of Consumer Data Control
The launch of DROP signals a new chapter in consumer privacy: one where individuals can exercise real, usable control over how their data is collected, sold, or stored.
For residents of California, this means access to a powerful privacy tool — and the knowledge that their state government has built, for the first time anywhere, a system capable of pushing privacy rights into everyday practice rather than leaving them on the books as theoretical entitlements.
Across the country, privacy advocates, legislatures, regulators, and tech companies will be watching the rollout and implementation of DROP closely. What happens in California often presages broader shifts in technology policy, law, and consumer expectations.
By making personal data deletion and opt-out practical on a mass scale, California has redefined not just what privacy rights exist, but how they are exercised.
