A California resident can now walk into a single digital portal and tell 614 companies to stop selling their phone number, email address, browsing history, and inferred personal traits in one submission.
The tool is called DROP—Delete Request and Opt-out Platform—and it went live on January 1, 2026. Though data brokers don’t have to comply until August 1, the window for filing is open now. For the first time, California’s privacy law has a mechanism that actually works at scale.
- The Scale of Reach: DROP simultaneously sends deletion and opt-out instructions to 614 registered data brokers in a single submission, covering behavioral profiles, inferred health status, and precise geolocation data.
- The Compliance Window: After August 1, 2026, each registered broker has 45 days to process requests — creating a legally enforceable obligation to delete data that previously had no practical off switch.
- The Structural Limit: DROP does not cover Google, Meta, or unregistered data harvesters, meaning it addresses only a portion of the broader behavioral data market that has operated with minimal transparency for decades.
This matters because data brokers are the infrastructure that turns your life into a commodity. They collect fragments of your identity — your address, phone number, purchase history, browsing patterns, inferred health status, political leanings — and sell them to anyone with a credit card. Spammers. Scammers. Stalkers. Insurance companies. Law enforcement. The system has no built-in off switch. Until now.
California passed the Delete Act in 2023, codifying a right that already existed on paper: residents could request deletion and opt-out of sale from any company holding their data. The problem was friction. Requesting deletion from one data broker meant finding that broker, locating their opt-out form, submitting your information, and repeating the process hundreds of times. Most people never tried. The brokers knew this. Friction was the feature.
How Does DROP Actually Work?
DROP removes the friction. When you file a DROP request through the California Privacy Protection Agency’s website, your deletion and opt-out instruction flows to all registered data brokers simultaneously. As of now, that’s 614 companies. After August 1, each broker has 45 days to process the request. Your social security number, precise geolocation, email, phone number, and browsing history get flagged for deletion. So do the inferences brokers have constructed about you — guesses about your pregnancy status, chronic illness, political views, or financial vulnerability, often derived from your purchases or web activity.
Some information stays. Vehicle and real estate ownership, matters of public record, won’t disappear. But the vast majority of the behavioral and identifying data that makes you a profitable target will vanish from 614 databases in a coordinated sweep.
• 614 registered data brokers are currently covered by DROP as of January 2026
• 45 days is the maximum compliance window each broker has after August 1 to process deletion requests
• Data categories flagged for deletion include precise geolocation, browsing history, inferred health status, political leanings, and financial vulnerability profiles
• A January 2025 Federal Register rule on sensitive personal data access documented cybersecurity researchers monitoring black-market services trading in the same categories of data DROP now targets
The personal benefit is immediate and tangible. Data brokers are how spammers acquire your contact information at scale. Removing yourself from their inventories means fewer unsolicited messages. It also shrinks your attack surface. Every company holding your data is a potential breach victim; fewer holders means fewer opportunities for hackers to steal your information. And it restores a basic asymmetry: you get to decide whether your life is for sale.
Why Does the Data Broker System Exist in the First Place?
The structural significance of DROP runs deeper than individual privacy protection. The tool exposes how data brokers have operated for decades — as a shadow market in human behavior, functioning with minimal transparency and zero consent from the people whose data they trade. The Cambridge Analytica scandal and the rise of surveillance capitalism revealed one version of this machinery: the 2016 Facebook-to-Analytica pipeline that weaponized psychological profiles to micro-target voters. But Analytica was never the only actor. Data brokers had been assembling and selling behavioral inventories on hundreds of millions of people continuously, with almost no public awareness. They built the infrastructure that made Analytica possible. DROP is the first tool that lets ordinary people opt out of that infrastructure entirely.
The parallel between data broker operations and the Cambridge Analytica model is not incidental. Both systems depend on the same core mechanism: aggregating behavioral signals from multiple sources, constructing inferred profiles without direct consent, and selling access to those profiles for targeting purposes. As documented in analyses of Cambridge Analytica’s legacy for digital accountability, the scandal’s most important revelation was not that one firm abused data — it was that the entire ecosystem enabling that abuse remained intact afterward. DROP is a direct legislative response to that ecosystem.
• The Electronic Frontier Foundation, which advocated for the Delete Act and DROP, frames the tool as a privacy control mechanism that converts a theoretical right into a practical one — removing the friction that brokers had relied upon as a structural defense
• The EFF emphasizes that DROP is powerful but incomplete: it covers registered brokers only, leaving Google, Meta, and unregistered data harvesters outside its scope
• The organization recommends treating DROP requests as a recurring practice, not a one-time action, and has created “Opt-Out October” as a privacy awareness framework for ongoing data hygiene
Is the DROP Filing Process as Simple as It Sounds?
Filing is straightforward. You go to the California Privacy Protection Agency’s DROP website and submit your name, address, phone number, and email. Yes, there’s an irony in handing over personal information to delete personal information. The agency is legally bound not to sell or share what you submit. You can also include optional identifiers like your advertising ID or vehicle identification number if you want those erased from broker databases. After submission, you receive a DROP ID to track your request’s status.
The process takes minutes. The impact, if you’re a California resident, is substantial. The opt-out of sale should persist indefinitely, though California’s privacy law still permits data brokers to collect new information about you without permission in most cases. They’ll simply have less data and fewer ways to use it. New brokers may register after you file. And DROP only covers registered data brokers — not the hundreds of unregistered data harvesters operating in legal gray zones. The risk of data exposure through those channels, including the vulnerability of personal information in large aggregated databases to hacking, does not disappear with a DROP request.
What Does DROP Signal About the Future of Privacy Regulation?
The EFF emphasizes that DROP is powerful but incomplete. California still needs stronger privacy laws. The tool should be part of a broader privacy strategy, not a substitute for one. For non-California residents, DROP is state-specific — but versions of the Delete Act have been introduced across the country. Virginia’s 2026 legislative session introduced HB638, which addresses data broker relationships with consumers directly, reflecting the national momentum California’s model has generated. Regulators are watching how California’s system performs. If it works — if brokers comply, if residents see measurable reductions in spam and exposure — other states will likely adopt similar mechanisms.
The tool’s launch also signals a shift in how privacy regulation is being conceived. Rather than abstract rights on paper, DROP is a usable mechanism. It assumes most people won’t manually hunt down 614 companies. It removes that assumption as a barrier. It turns a theoretical right into a practical one. Whether the data broker industry absorbs the compliance cost, lobbies to weaken the rule, or migrates operations in response will determine how durable that right proves to be. The question experts are now asking — whether the conditions that enabled Cambridge Analytica-style data exploitation could recur — is examined directly in current analysis of whether another Cambridge Analytica scandal is possible today. DROP represents one answer: a structural intervention designed to make the underlying data market slightly less frictionless, slightly less profitable, and slightly more accountable.
If you’re a California resident, filing a DROP request takes less time than reading this article. The 45-day compliance clock starts August 1. After that, you’ll be in the system, and 614 data brokers will have a legal obligation to forget you.
