DROP Data Brokers: California DELETE Act Portal Guide
One request to delete your data from hundreds of brokers.
Last updated: February 2026
Key Dates
- January 1, 2024: DELETE Act (SB 362) took effect
- August 1, 2026: DROP portal goes live
- 45 days: Maximum time brokers have to process requests
What Is the DELETE Act?
The California Delete Act (SB 362), signed in October 2023, is the most significant data privacy legislation since CCPA. It creates a single, free mechanism for consumers to request deletion of their personal information from all registered data brokers at once.
Previously, opting out of data brokers meant visiting hundreds of individual websites, filling out different forms, and tracking each request separately. The DELETE Act changes this by creating a centralized portal called DROP (Data Broker Registry Opt-Out Portal).
What Is the DROP Portal?
DROP (Data Broker Registry Opt-Out Portal) is a free service operated by the California Privacy Protection Agency. When you submit a request through DROP:
- Your deletion request is sent to all registered data brokers
- Brokers must process your request within 45 days
- Brokers must delete your data and not re-collect it for one year
- You can renew your request annually to maintain protection
DELETE Act Timeline
The DELETE Act has been years in the making. Here's the full legislative timeline:
October 10, 2023 — Governor Signs SB 362
Governor Gavin Newsom signs the DELETE Act (SB 362) into law, authored by Senator Josh Becker. California becomes the first state to mandate a centralized data broker deletion mechanism.
January 1, 2024 — Law Takes Effect
Core provisions activate. Data brokers must register with California and begin preparing for the deletion mechanism. Registration fees fund the program.
January 31, 2025 — Broker Registration Deadline
All data brokers operating in California must register with the California Privacy Protection Agency (CPPA). Over 500 brokers have registered.
August 1, 2026 — DROP Portal Launches
The DELETE Request Online Portal (DROP) goes live. Californians can submit a single request to delete their data from all registered brokers.
January 1, 2028 — Accessible Deletion Mechanism
CPPA must implement an "accessible deletion mechanism" for consumers — the portal is expected to be fully mature and widely adopted by this date.
Who Can Use DROP?
The DELETE Act applies to California residents. However, many data brokers apply deletion requests nationwide rather than maintaining separate California-only processes.
You qualify if:
- You currently reside in California, OR
- You have a California address on file with data brokers
Not in California?
19 states now have comprehensive privacy laws. Check our State Rights Lookup to see what protections you have.
How to Use DROP (Step-by-Step)
Visit the DROP Portal
Go to the California Privacy Protection Agency website (link available August 2026). The portal will be free to use.
Verify Your Identity
You'll need to confirm your identity. This typically requires:
- Full legal name
- Current and previous addresses
- Email addresses associated with your data
- Possibly additional verification (varies by implementation)
Submit Your Request
Once verified, submit your deletion request. DROP will automatically send it to all registered data brokers (expected to be 500+).
Wait for Processing
Brokers have 45 days to process your request. You'll receive confirmation when complete. Some brokers may contact you to verify specific records.
Renew Annually
Brokers are prohibited from re-collecting your data for one year after deletion. Set a calendar reminder to renew your request annually for ongoing protection.
How Many Data Brokers Are Registered?
As of early 2026, over 500 data brokers have registered with the California Privacy Protection Agency. This number continues to grow as enforcement increases. Some notable categories:
500+
Registered data brokers
45 days
Maximum processing time
$200/day
Penalty for non-registration
1 year
Re-collection prohibition
The broker registry is public. Here's who's registered, by category:
People Search Sites
These brokers collect your name, address, phone, and relatives from public records and sell access. They're the most visible type of data broker. You can opt out of the major ones right now:
- Spokeo — 5 min opt-out
- Whitepages — 10 min opt-out
- BeenVerified — 5 min opt-out
- Intelius — 10 min opt-out
- MyLife — 15 min opt-out
- PeopleFinder, TruePeopleSearch, FastPeopleSearch, and dozens more
Marketing Data Companies
These brokers aggregate consumer data for advertising and marketing. They build detailed profiles used for targeted ads, junk mail, and telemarketing. Major registered brokers include Acxiom, Epsilon, LiveRamp, Oracle Data Cloud, and TransUnion (marketing division).
Background Check & Risk Assessment
Companies that aggregate criminal records, employment history, and financial data for tenant screening, employment checks, and risk assessment. Note: credit bureaus (Equifax, Experian, TransUnion) are regulated separately under the FCRA and are NOT covered by DROP.
What DROP Covers
All data brokers registered with California must participate in DROP. This includes companies that:
- People search sites: Spokeo, BeenVerified, Whitepages, etc.
- Marketing data companies: Acxiom, Epsilon, Oracle Data Cloud
- Background check aggregators: Various consumer data aggregators
- Location data brokers: Companies selling location history
What DROP Doesn't Cover
The DELETE Act specifically targets data brokers. It does NOT cover:
- Companies you have a direct relationship with: Your bank, employer, doctor
- Government records: DMV, court records, property records
- Credit bureaus: Equifax, Experian, TransUnion (covered by FCRA)
- Social media platforms: Facebook, Instagram (you have accounts there)
Other States With Data Broker Laws
California's DELETE Act is the most comprehensive, but other states are following suit. If you're not in California, you may still have options:
| State | Law | Key Feature | Status |
|---|---|---|---|
| California | DELETE Act (SB 362) | One-click deletion via DROP portal | DROP Aug 2026 |
| Vermont | Data Broker Registry (H.764) | First state broker registry, annual reporting | Active since 2019 |
| Oregon | Oregon Consumer Privacy Act | Deletion rights, data broker obligations | Active 2024 |
| Texas | Data Privacy and Security Act | Data broker registration, opt-out rights | Active 2024 |
| Connecticut | CT Data Privacy Act (CTDPA) | Deletion and opt-out rights for consumers | Active 2023 |
| Colorado | Colorado Privacy Act (CPA) | Universal opt-out mechanism required | Active 2023 |
| Virginia | VCDPA | Deletion rights, data minimization | Active 2023 |
| New Jersey | NJ Data Privacy Act | Comprehensive privacy rights, deletion requests | Active 2025 |
| Delaware | Delaware Personal Data Privacy Act | Opt-out and deletion rights | Active 2025 |
| Montana | MT Consumer Data Privacy Act | Deletion rights for consumers | Active 2024 |
| New Hampshire | NH Privacy Act | Data deletion and portability | Active 2025 |
| Iowa | Iowa Consumer Data Protection | Deletion rights (narrower scope) | Active 2025 |
| Utah | Utah Consumer Privacy Act (UCPA) | Opt-out rights, data deletion | Active 2023 |
| Indiana | IN Consumer Data Protection Act | Opt-out and deletion rights | Active 2026 |
| Tennessee | TN Information Protection Act | Deletion and opt-out rights | Active 2025 |
| Minnesota | MN Consumer Data Privacy Act | Comprehensive deletion and opt-out rights | Active 2025 |
| Maryland | MD Online Data Privacy Act | Strong deletion rights, data minimization | Active 2025 |
| Nebraska | NE Data Privacy Act | Deletion and correction rights | Active 2025 |
| Kentucky | KY Consumer Data Protection Act | Opt-out and deletion rights | Active 2026 |
A total of 19 states now have comprehensive privacy laws. Use our State Rights Lookup tool to check what protections apply in your state.
Before DROP Goes Live
DROP launches in August 2026. You don't need to wait — you can manually opt out of the biggest data brokers right now. Here's a prioritized plan:
Quick Win: Remove Yourself from 5 Major Brokers in 2 Hours
- Spokeo — 5 minutes, easy
- BeenVerified — 5 minutes, easy
- Whitepages — 10 minutes, medium
- Intelius — 10 minutes, medium
- MyLife — 15 minutes, harder
These 5 brokers are the most commonly used people-search sites. Removing yourself from them covers the majority of easily-found personal data online. Use our Opt-Out Tracker to track your progress.
Penalties for Non-Compliance
The DELETE Act has teeth. Data brokers who fail to comply face:
- $200 per day for failing to register with California
- Administrative fines for not processing deletion requests
- Enforcement actions from the California Privacy Protection Agency
Frequently Asked Questions
Is DROP really free?
Yes. The DELETE Act explicitly prohibits charging consumers for using DROP. It's funded by registration fees that data brokers must pay.
Will my data come back after deletion?
Brokers are prohibited from re-collecting your data for one year after deletion. However, you should renew your request annually. New data sources may also emerge.
Can I use DROP if I moved away from California?
You need to be a California resident at the time of the request. However, many brokers apply deletions nationwide anyway. Check your current state's laws too.
How is DROP different from paid services?
Paid services like DeleteMe manually submit opt-out requests to brokers individually. DROP is a legal mandate—brokers MUST participate. However, paid services may still be useful for ongoing monitoring and non-California coverage.
What if a broker doesn't delete my data?
You can file a complaint with the California Privacy Protection Agency. They have enforcement authority and can levy fines against non-compliant brokers.
When does the DROP portal launch?
The DROP portal is scheduled to launch on August 1, 2026. The California Privacy Protection Agency (CPPA) has been building the system since the DELETE Act took effect in January 2024.
Can I opt out of data brokers without DROP?
Yes. You can manually opt out of individual data brokers right now. Our Data Broker Opt-Out Guide has direct links and step-by-step instructions for the 12 biggest brokers. DROP will make this much easier by automating all requests into one.
What is a data broker under California law?
California defines a data broker as a business that "knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." This means companies like Spokeo, BeenVerified, and Whitepages that collect your data from public records and sell it — not companies you interact with directly.
Does DROP work for minors?
Yes. The DELETE Act includes specific protections for children's data. Parents or legal guardians can submit deletion requests on behalf of minors. Brokers face additional penalties for retaining data about children under 16.
Will other states create their own DROP portals?
It's possible. Several states are watching California's implementation closely. A federal privacy bill with similar provisions has been proposed but hasn't passed. In the meantime, 19 states have their own privacy laws with deletion rights — check our State Rights Lookup for your state.
Does DROP handle name changes or multiple addresses?
The DROP portal will allow you to submit multiple name variations and addresses. This is important if you've changed your name (marriage, divorce, legal name change) or moved frequently — data brokers often have records under old names and previous addresses. Submit all known variations for the most complete deletion.
How do I file a complaint if a broker ignores my DROP request?
The California Privacy Protection Agency (CPPA) handles enforcement. After August 2026, you'll be able to report non-compliant brokers directly through the DROP portal. CPPA can impose fines of $200/day for registration violations and additional administrative penalties for ignoring deletion requests. Keep records of your submission date — the 45-day clock starts then.
Is DROP better than DeleteMe or Incogni?
DROP and paid services serve different purposes. DROP is free and legally enforceable — all registered brokers must comply. Paid services like DeleteMe ($129/yr) and Incogni ($77/yr) offer ongoing monitoring, cover more brokers beyond California's registry, and handle re-removal automatically. If you're in California, use DROP first, then consider a paid service for extra coverage. Read our Paid vs DIY comparison for the full breakdown.
We'll Update This Guide
When DROP goes live in August 2026, we'll update this guide with direct links, screenshots, and any changes to the process. Bookmark this page or check back then.
While You Wait for DROP: Protect Your Data Now
DROP launches in August 2026. In the meantime, a VPN prevents new data collection by hiding your IP address and encrypting your browsing activity.