California Residents Can Use One DROP Request to Seek Deletion From 614 Data Brokers

The state’s Delete Request and Opt-out Platform is live, but registered brokers do not have to begin processing requests until Aug. 1 and will then have 45 days to respond.

California residents can use the state’s Delete Request and Opt-out Platform, known as DROP, to send one request asking every data broker registered with California to delete their personal information and stop selling or sharing it.

The tool is designed to replace a burdensome process in which residents would otherwise need to identify individual data brokers and submit separate privacy requests to each company. The Electronic Frontier Foundation said a single DROP request currently reaches 614 brokers listed in California’s registry.

Data brokers collect information about people, package it into profiles or datasets, and sell or exchange it with other businesses. That can include contact details such as email addresses and phone numbers, along with other personal information gathered from commercial and public sources.

For residents, the practical appeal is straightforward: one filing can trigger deletion and sale opt-out requests across a broad group of registered brokers. EFF said reducing the number of brokers holding a person’s data could reduce unwanted marketing messages and limit the number of companies exposed to that information in a breach.

DROP launched Jan. 1 under California’s Delete Act. However, the system’s compliance effect has an important deadline. Registered data brokers have until Aug. 1 to begin complying with requests. After that date, brokers that receive a DROP request will have 45 days to address it, EFF said.

That schedule means Californians can submit requests now, but should not assume that brokers will have acted on them before the Aug. 1 compliance start date. For compliance teams at data brokers, Aug. 1 is the operational deadline that matters: firms registered in California will need processes to receive requests from the platform, identify the requester’s information, apply deletion and opt-out controls, and meet the 45-day response window.

The platform’s reach is tied to California’s data broker registry, not to every company that may hold a resident’s data. A DROP filing sends requests to brokers registered with the state. It does not necessarily cover retailers, employers, financial institutions, service providers, or other businesses that collect data directly and may fall outside the registered-broker population.

There is also uncertainty around outcomes. EFF identified 614 brokers reachable through a single request, but it did not specify whether every broker is currently processing requests successfully, how identity verification will work in individual cases, or what confirmation residents will receive after filing. Residents should therefore treat DROP as a broad privacy-control mechanism rather than a guarantee that all personal data held by every business will immediately disappear.

Still, the platform changes the enforcement model for California’s data broker privacy rights. Instead of placing the entire burden on individuals to locate and contact hundreds of companies, DROP centralizes the initial request and gives registered brokers a defined compliance clock once Aug. 1 arrives.