You filed a deletion request through California's DROP platform, and nothing happened. No confirmation, no deletion, no reply. That silence might be normal, or it might be a broker breaking the law, and the difference is a clock you cannot see. DROP, the Delete Request and Opt-out Platform, opened to California consumers on January 1, 2026. Brokers have to retrieve requests from it at least once every 45 days, and process each request within 45 days of receipt. The penalty for failing is 200 dollars per request, per day.
The Delete Act, SB 362, signed in October 2023, built the platform. One consumer request covers all 590-plus registered data brokers, and the consumer verifies residency through the California Identity Gateway or Login.gov, then gets an 8 digit DROP ID. The broker side of that transaction is where the clock runs, and it started on August 1, 2026.
DROP is the California Delete Request and Opt-Out Platform, run by the California Privacy Protection Agency. One verifiable request through DROP covers every data broker registered with the state, and those brokers must check the tool at least once every 45 days and process requests. It applies only to California residents and only to registered brokers.
The California Delete Act requires data brokers to register with the state, and DROP is the platform where residents file a single deletion request that reaches all of them. More than 500 companies had registered when the annual registration window closed on January 31, 2026. Registered brokers must check DROP at least once every 45 days and process the requests they find there, with processing starting August 1, 2026. That 45-day check is the enforcement mechanism: the request does not sit in an inbox, it sits in a system the broker is legally required to consult.
The request is verifiable, which means the state confirms the requester is who they say they are, and the broker then has to delete the personal information it holds and stop selling it. The broker also has to tell its service providers. The scope is the registered broker's own data, which is the point: one filing replaces dozens of separate opt-out forms, each with its own verification step.
DROP reaches registered brokers only. A people-search site that has not registered is not in the system, and neither is a broker operating outside California's registration rules. The big names, Spokeo, Whitepages, BeenVerified, are covered to the extent they registered, but the long tail of smaller brokers and the sites that scrape without registering are not. That is why the manual opt-out calendar still matters: DROP handles the registered middle, and the manual sweep handles the rest.
It also does not cover non-residents. The Delete Act is a California law for California residents, and a resident of another state cannot file through DROP. The other state laws, Colorado, Virginia, and the rest, give their residents deletion rights against brokers operating there, but none of them built a single-door platform like DROP. California residents have the tool, and most of them have never opened it.
Go to the CPPA DROP portal and submit a verifiable request with the identifying information the platform asks for. The state verifies the request, and the registered brokers then have to process it on their 45-day check cycle. The timeline is not instant: the broker has up to 45 days to check and then its own processing window, so expect weeks, not days, before the listings thin out.
After filing, keep the manual calendar for the sites DROP does not reach, and re-check the registered brokers after 45 days to confirm the deletion took. If a registered broker has not processed the request after its check cycle, that is a compliance failure, and the CPPA is the place to report it. DROP is a legal tool with a paper trail, which is exactly what makes it stronger than a form on a broker's own site.
Keep reading: Who we protect covers a nearby case in this series.
The Delete Request and Opt-Out Platform, run by the California Privacy Protection Agency. One verifiable request through DROP covers every data broker registered with the state under the California Delete Act.
At least once every 45 days. Registered brokers must check the tool on that cycle and process the requests they find, with processing starting August 1, 2026.
No. It covers brokers registered with California, more than 500 companies as of January 2026. Unregistered brokers and sites outside the system are not reached, so manual opt-outs are still needed for those.
No. DROP is for California residents under the California Delete Act. Other states give their residents deletion rights, but none of them built a single-door platform like DROP.