In the modern digital economy, data has become a currency. Data brokers in some cases sell data points connected to your online usage.

With the passage of the California Delete Act and the launch of the DROP platform, California has officially created a way to remove that data.

This is the first time in history that a government has provided a centralized, “one-click” solution to tell hundreds of data brokers to delete your information simultaneously. In this guide, I’m going to break down what the Delete Act is, how the DROP system works, and why this is a massive shift for both consumers and businesses.

The information provided is based on official resources from privacy.ca.gov. This is not legal advice. If you require legal counsel regarding data privacy or compliance, please consult with a qualified Professional.

What is the California Delete Act?

Passed in 2023 as Senate Bill 362, the Delete Act is a landmark piece of legislation that expands upon the protections already established by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

While previous laws gave you the right to ask individual companies to delete your data, the process was tedious. You had to find every single data broker and submit a request one by one. The Delete Act changes the game by requiring the California Privacy Protection Agency (CPPA) to create a central “accessible deletion mechanism.” Which by the way is not going to be an easy think for every business to do online. This is a lift!

According to the official About DROP and the Delete Act page, this law makes California:

• The first in the world to provide a centralized deletion platform.

• One of only four states (alongside Oregon, Texas, and Vermont) that require data broker registration.

Key Requirements of the Act:

1. Centralized Deletion: Consumers can submit a single request to delete their personal information across all registered data brokers.

2. Mandatory Registration: Data brokers must register with the CPPA every year.

3. Audits: Every three years, data brokers must undergo an independent audit to ensure they are actually complying with these deletion requests.

4. No Cost: The service must be free for all California residents.

Introducing DROP: Your Privacy Command Center

DROP stands for the Data Removal and Opt-Out Platform. It is the actual tool built by the state of California to put the Delete Act into action. It is good they tool the time to build this system. 

Think of DROP as a “Do Not Call” list, but for your entire digital identity. Instead of just blocking phone calls, you are removing your data from the databases that fuel targeted advertising, background checks, and risk-profiling algorithms.

How DROP Works: A Step-by-Step Breakdown

Based on the How DROP Works documentation, here is how you can reclaim your privacy:

Step 1: Verify Your Eligibility

To use DROP, you must be a California resident. The state uses the California Identity Gateway to verify your residency securely. You can do this by entering basic info or using a Login.gov account. The system is designed to verify who you are without actually storing your personal information in a permanent database.

Step 2: Create Your Profile

You provide the data you want deleted. Data brokers will use this information to find a “match” in their systems. The types of data you can submit include:

• Full names (including maiden names).

• Date of birth and ZIP code.

• Email addresses and phone numbers.

• Unique Identifiers: This is a critical technical component. You can provide your Mobile Advertising ID (MAID), Connected TV ID, and even your Vehicle Identification Number (VIN).

Step 3: The Deletion Request

Once you submit, the request is sent to over 500 registered data brokers. Starting August 1, 2026, these brokers are required by law to begin processing these requests.

Pro Tip: According to privacy.ca.gov, once a broker finds a match, they must delete all information they have about you—not just the specific pieces of data you provided in the request. This includes “inferred information,” which are the assumptions or profiles they’ve built about your personality or habits.

Deep Dive: Personal Information and Unique Identifiers

To get the most out of the Delete Act, you need to understand what “personal information” actually covers. Under California law, it isn’t just your name and Social Security number. It includes anything that “identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked” to you or your household. 

What are Data Brokers Collecting?

According to the Personal Information and Data Brokers resource, brokers collect:

• Identifiers: Real name, alias, postal address, IP address.

• Commercial Info: Records of personal property, products or services purchased or considered.

• Biometric Info: Genetic, physiological, and biological characteristics.

• Internet Activity: Browsing history, search history, and interactions with websites or ads.

• Geolocation Data: Your physical location history.

Data brokers are people who sell your data but it should be noted companies not selling your data should delete on request as well. While the Delete Act is the “new shiny object” that specifically targets data brokers, the obligation for other businesses to delete your data has actually been around for a few years. If a company is not a data broker (meaning you have a direct relationship with them, like your bank, your favorite clothing store, or a social media platform), they are still required to delete your data upon request under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

The Role of Unique Identifiers

One of the most powerful parts of DROP is the ability to submit Unique Identifiers. These are the “digital fingerprints” that follow you across devices.

• MAID (Mobile Advertising ID): A string of digits assigned to your smartphone. Advertisers use this to track which apps you use.

• Connected TV ID: Used by smart TVs to track what you watch.

• VIN (Vehicle Identification Number): Modern cars are “computers on wheels” that collect massive amounts of driving and location data.

By including these in your DROP request, you are essentially “breaking the link” between your physical self and your digital tracking IDs. You can learn how to find these on your devices at the Unique Identifiers page.

Understanding the Request Statuses

After you submit a request through DROP, you’ll receive a DROP ID. You can use this to track how data brokers are handling your data. There are five main statuses you might see:

1. Deleted: The broker found a match and removed your data.

2. Exempted: Some data is legally protected from deletion (like public records or certain health records).

3. Opted-out: They couldn’t find an exact match to delete, but they are now legally barred from selling any data they might have on you.

4. Record Not Found: The broker doesn’t have your info.

5. Pending: The broker has up to 45 days (and in some cases 90) to process the request.

What This Means for Businesses

If you are a business owner or marketer, the Delete Act is a wake-up call. The era of buying cheap “third-party lists” to fuel your marketing is coming to an end.

1. Data Broker Compliance: If your business meets the definition of a “data broker” (earning revenue from selling personal info of consumers you don’t have a direct relationship with), you must register with the CPPA and integrate with DROP. 

2. Shift to First-Party Data: Since DROP does not delete data you gave directly to a business (first-party data), companies must focus on building direct relationships with their customers.

3. The Transparency Dividend: Brands that are transparent about how they use data will win in this new environment. Consumers are more likely to share data with brands they trust if they know they have the power to take it back.

Why the Delete Act is a Global Initiative to Watch

For years, privacy advocates have argued that “notice and consent” (those annoying cookie pop-ups) isn’t enough. The Delete Act puts more of the “burden of labor” on the companies rather than the consumer.

By centralizing the process through DROP, California has removed the friction that kept people from exercising their privacy rights. As other states and countries look at the success of this platform, we can expect similar “Delete Buttons” to pop up globally.

Resources for Consumers

Check out the DROP Toolkit. It provides templates, guides, and more information on how to navigate these new rights.

Next Steps on The Delete Act

The rules on the web are getting tighter every year. The California Delete Act and the DROP platform make it easier for consumers to control their online experience and what data people have about them. W

Sources:

• About DROP and the Delete Act – privacy.ca.gov

• How DROP Works – privacy.ca.gov

• Personal Information and Data Brokers – privacy.ca.gov

• Unique Identifiers Guide – privacy.ca.gov

• Consumer Resources & DROP Toolkit – privacy.ca.gov

This article was written by John Lincoln and is based on information from https://privacy.ca.gov/drop/. While John is a business and digital expert, this is not legal advice.