California is offering residents a new resource designed to help them more effectively restrict data brokers from collecting and selling their personal details.
Although state residents have been able to request that a company cease collecting and selling their information since 2020, actually accomplishing this has proven challenging.required a laborious processchoosing to opt out with each specific company. The Delete Act,passed in 2023was intended to make things easier, enabling residents to submit one request that would have over 500 registered data brokers remove their information.
Now the Remove Requests and Unsubscribe Portal(DROP) actually empowers residents to submit such a request. After DROP users confirm their residency in California, they can file a deletion request that will be sent to all current and future data brokers registered with the state.
However, this does not automatically imply that all your information will be removed right away. Brokers are required to begin handling requests in August 2026, after which they will have 90 days to process those requests and provide feedback. Should they fail to remove your data, you will have the chance to provide further details that could assist them in finding your records.
Businesses will also have the ability to retain first-party data they have gathered from users. Only intermediaries looking to purchase or sell this data—such as your social security number, browsing history, email address, phone number, and other personal information—will be obligated to remove it.
Certain data, including vehicle registration details and voter information, is excluded from deletion since it originates from public records. Additional data, such as confidential medical information, might be protected by other regulations like HIPAA.
The California Privacy Protection Agency states that along with providing residents greater control over their information, the tool may lead to fewer “unwanted messages, calls, or emails” and also reduce the “possibility of identity theft, fraud, AI impersonation, or instances where your data is disclosed or compromised.”
The fine for data brokers that do not register or neglect to remove consumer data as requested is $200 each day, along with enforcement expenses, as stated by the agency.