California DROP Explained: One Request to Every Registered Data Broker

DROP, California's Delete Request and Opt-out Platform, gives state residents a single place to ask every registered data broker to delete their information and stop selling it.

CalPrivacy, the name the California Privacy Protection Agency now uses, operates the platform.

This guide explains who can use DROP, how to submit a request, what each status means and what the dates promise. It uses CalPrivacy's pages, the Delete Act text and independent research, checked on October 11, 2026.

The short answer

DROP opened to California consumers on January 1, 2026. From August 1, 2026, brokers have been required to process DROP requests, and they must check the platform at least once every 45 days.

CalPrivacy tells consumers that status updates can take as long as 90 days, depending on the broker. Neither the 45-day nor the 90-day figure promises that every record will be deleted.

What DROP is and the law behind it

DROP was created under the Delete Act, signed in October 2023 as SB 362. Civil Code section 1798.99.86 told CalPrivacy to build one mechanism for deletion requests. CalPrivacy's October 2026 FAQ says it covers more than 650 registered brokers.

Since August 1, 2026, the law has required each broker to visit the platform at least every 45 days, and to act on a request within 45 days of receiving it.

Once a broker has deleted your data, it must repeat the deletion at least every 45 days and cannot sell or share newer data about you, unless you tell it otherwise or an exception covers the data.

When a broker cannot verify a request and refuses to delete, the statute requires it to handle the request as an opt-out of sale or sharing instead.

Key dates and what they mean

Date	What happened	What it means for you
October 2023	The Delete Act was signed as SB 362	California required a deletion platform
January 1, 2026	California consumers could start using DROP	Your request could be filed
August 1, 2026	Brokers had to begin processing requests	Statuses can start updating, and CalPrivacy says updates could take up to 90 days
November 2026	CalPrivacy expects all brokers to have finished their first download and upload cycle	Brokers must keep deleting every 45 days

Three events matter: when you could submit, how often brokers must act, and when you may see results. They are different dates, and none of them is a deletion guarantee.

Each broker has to download the request lists at least every 45 days. After a download, it has 45 days to report a status for each request. CalPrivacy's consumer pages tell you to allow up to 90 days.

CalPrivacy does not explain how the 45 and 90 relate. Our reading is that a request filed just after a download waits up to 45 days for the next one.

Then the broker has up to 45 days to report, which adds up to about 90.

Who can use DROP

Only people who live in California can use it. CalPrivacy counts you as eligible if California is your home, including when you are away for a temporary or transitory reason.

Residents of other states cannot use DROP. The UC Irvine authors note that people in places such as Vermont, Texas and Oregon must contact brokers one at a time.

The California Identity Gateway, which the California Department of Technology operates, confirms that you live in the state. According to CalPrivacy, DROP keeps only a record that the Gateway verified you, and none of the details you typed in.

You can enter details directly or use Login.gov, which CalPrivacy suggests only if you already have an account. DROP's terms say state-contracted vendors, including Socure and Login.gov, assist with verification.

Because DROP does not keep those details, you may enter some of them, such as your phone number and email, a second time when you build your request.

In some situations you may file for another California resident, for example a parent acting for a child, with that person's permission. You must verify that person's residency.

What you need, and how to submit a request

1. Open privacy.ca.gov/drop and select Get started with DROP.
2. Confirm your California residency.
3. Enter your name, date of birth and ZIP code as your profile basics.
4. Add any email addresses and phone numbers you use, and optional identifiers if you have them.
5. Review the details, then submit your request.
6. Save the DROP ID on the confirmation page and keep it private.

CalPrivacy's how-it-works page says a name, date of birth and ZIP code are the minimum. Its FAQ says DROP also asks for email and phone, because a name alone may not let a broker find your record.

You may also add a mobile advertising ID, a connected TV identifier and a vehicle identification number, but none are required. Apart from your date of birth, you can enter several values for each item.

Your DROP ID has 8 to 10 letters and numbers, according to the status page. Another CalPrivacy page says 8 digits, so go by what your confirmation page shows.

You can come back to add information. The statute lets you alter a request after at least 45 days, and CalPrivacy's help page says updates are allowed once every 45 days.

CalPrivacy's other pages do not say whether adding an optional identifier soon after submitting counts as an update. If DROP blocks an edit, wait out the 45 days.

What each DROP status means

Brokers report one of four codes, defined in CalPrivacy's status code reference: Deleted, Exempted, Opted out and Not found. Pending is what you see before they report.

The difference matters. Opted-out means the broker matched an identifier and restricted sale and sharing instead of deleting. Record not found means no match, so nothing was deleted.

Even then, the broker must keep your request on a list to screen newly collected records. CalPrivacy says Record not found could later change to Deleted, and you do not need to resubmit.

These continuing duties are legal requirements. The CalPrivacy pages we read do not describe how later cycles appear on your status screen, so check your DROP ID from time to time.

How to check your status

1. Go to consumer.drop.privacy.ca.gov/dropstatus.
2. Enter your DROP ID.
3. Read the status for each broker.
4. Add more information to your profile if you see Opted-out or Record not found.

What DROP does not remove

The statute says data a broker keeps under an exception may be used only for that purpose, not for marketing.

CalPrivacy also says that if brokers delete your data, you may see fewer targeted ads or less personalized content.

For sites DROP does not reach, such as unregistered people-search sites, see how to opt out of data brokers in 2026, which covers manual opt-outs and prescreened credit offers.

What happens if a broker does not comply

The Delete Act lets CalPrivacy impose an administrative fine of $200 per deletion request for every day a broker misses its deletion duty, along with costs. CalPrivacy's own pages phrase the same fine as $200 per day for each consumer.

A fine requires an administrative action by CalPrivacy. An unresolved status does not by itself show a violation, and the pages we read do not provide for payments to consumers.

You can file a complaint with CalPrivacy. It enforces California privacy law and may use complaints to monitor compliance. It does not represent individual consumers.

Independent research: UC Irvine researchers posted a July 2026 preprint on arXiv. They sent requests to California-registered brokers in late 2025 using fictitious identities, before DROP processing began.

Most brokers seemed compliant, but many did not reply, and some asked for more verification than the authors say CCPA rules allow for opt-outs. The preprint did not test DROP.

It lists no publication venue, so treat it as not yet peer reviewed. We found no independent study yet of how brokers handle DROP requests.

What CalPrivacy reports so far

In its October 2026 FAQ, CalPrivacy says more than 550,000 Californians had signed up by early October. It says that in the first three months of processing, 99 percent of consumers had information deleted by at least one broker.

It also says 70 percent had information deleted by 100 or more brokers. These are agency-reported figures. The FAQ does not say how much data was deleted, and they are not independent research.

How DROP protects your information

CalPrivacy says your data is hashed, or scrambled into a code, as soon as you enter it, so no one in the State can read it.

Brokers scramble their own records with the same method, so they only learn whose data to delete when a match turns up.

Hashing does not make your data anonymous to a broker that already holds the same identifier, because it can produce the same code. It stops the list being read as plain text, not from being matched.

DROP uses six identifier sets for matching: name with date of birth and ZIP code, email, phone, mobile advertising ID, name with vehicle number, and connected TV ID. A name alone may not be enough.

If several people share an identifier, such as a family email address, the broker opts all of them out of sale and sharing instead of deleting.

Frequently asked questions

Is California DROP free?

Yes. The statute requires the mechanism to be free for consumers, and CalPrivacy says it will never charge you to use DROP.

Do I need to submit again if a broker gets my data later?

No. CalPrivacy says one submission is enough, because brokers must keep honoring it over time. Check your status with your DROP ID from time to time.

Is DROP the same as a CCPA deletion request?

No. A CCPA request reaches only the single business you send it to. DROP sends one request to every registered data broker, and each request also works as an opt-out.

What happens if a broker cannot match my information?

Your status may show Opted-out or Record not found. Add more identifiers to your profile when DROP allows an update, then check back.

Will DROP stop spam calls, texts and emails?

CalPrivacy says limiting how your data is sold can reduce unwanted messages, but results vary and may take time to notice.

A quick checklist

• Check that you qualify as a California resident.
• Gather your name, date of birth, ZIP code, emails and phone numbers.
• Submit one request and save your DROP ID.
• Check your status on CalPrivacy's DROP status page.
• Add more identifiers if you see Opted-out or Record not found.
• Keep opting out manually of sites that DROP does not reach.

Up nextDo data removal services work? What they can and cannot doIs it worth paying for a service on top of DROP? Our guide to whether data removal services work looks at what independent tests found.→