"Data broker" is an umbrella term. It covers firms that collect, aggregate, sell, resell, license, or otherwise share personal information with other parties, including companies a consumer has never dealt with directly (Federal Register/CFPB, 2023).

What they gather breaks down into five rough categories: core identity and contact details, everyday behavior such as credit card purchases and browsing activity, geolocation data, financial records, and sensitive traits including genetic, health, and religious information (CFPB, 2023).

None of that sits idle. It feeds advertising algorithms, credit and insurance underwriting models, fraud detection systems, employment background checks, and people-search databases (CFPB, 2023). Surveys cited in that same CFPB inquiry found consumers broadly uneasy about being tracked and wanting more say over how their information gets used (CFPB, 2023).

DROP is built for California residents. The platform verifies residency, then transmits the request to brokers (Gov. Newsom's office, Jan. 20). The tool exists because of SB 362, the Delete Act, which Governor Newsom signed into law in 2023, requiring the state to build an accessible way for consumers to exercise deletion rights against the broker industry (Gov. Newsom's office, Jan. 20).

The tool's reach is also limited to brokers registered with the state, 654 of them as of August 25, 2026, not every data broker doing business in the U.S. (CalPrivacy, Aug. 25). A broker that never registered with California simply isn't in the system DROP queries.

The difference between "deleted" and "opted out of sale" matters more than it sounds. A deleted record means the broker matched your information and erased what it isn't legally required to keep. An opt-out of sale happens for a more specific reason: the broker found multiple consumers tied to the identifiers submitted and, unable to isolate one record with confidence, can no longer sell or share the data even though it keeps holding it (CalPrivacy, July 10 explainer). Knowing that distinction ahead of time avoids the confusion of seeing "opted out" and assuming the broker has nothing left on file.

Brokers operate on a clock, too. They had to start retrieving and processing requests by August 1, 2026, and must keep checking the system at least every 45 days after that (CalPrivacy regulations, Nov. 2025). What that timeline means for how long a status takes to appear is covered below.

1. Go to privacy.ca.gov/DROP. This is the state's own deletion platform, built by CalPrivacy in partnership with the California Department of Technology (Gov. Newsom's office, Jan. 20).

2. Verify your California residency. DROP won't transmit a request to any broker until this step clears (Gov. Newsom's office, Jan. 20).

3. Build your profile with basic identifying information. Name, address, and similar core details form the baseline CalPrivacy compares against each broker's records when looking for a match (CalPrivacy, July 10 explainer).

4. Add optional identifiers if you have them. A mobile advertising ID, a connected-TV ID, or a vehicle identification number can help brokers find records that basic details alone might miss. More identifiers generally improve the odds of a match, though that's a trade-off worth weighing: the more you enter, the more data brokers have to compare against (CalPrivacy, July 10 explainer). CalPrivacy says every entry is hashed the moment it's submitted, so raw personal information is never stored on the platform or handed to brokers directly (CalPrivacy, July 10 explainer).

5. Submit the request. It's free, one-time, and generally takes under 10 minutes (CalPrivacy, Aug. 25).

6. Save your eight-digit DROP ID. It's the only way to check status later, so keep it somewhere you won't lose it (CalPrivacy, July 10 explainer).

Brokers must retrieve requests at least every 45 days starting August 1, 2026, then report a status within 45 days of retrieving them. That means an update can take up to 90 days to appear, not 45 (CalPrivacy regulations, Nov. 2025; CalPrivacy, July 10 explainer).

Each broker lands in one of five buckets: record deleted, record exempted (the broker is legally permitted to retain what it found), record opted out of sale (retained but can't be sold or shared), record not found, or pending (CalPrivacy, July 10 explainer).

The last three of those are easy to misread. A "not found" status can mean the broker genuinely has nothing on you, or it can mean the identifiers submitted didn't match closely enough to what's already in its system (CalPrivacy, July 10 explainer). CalPrivacy's published guidance doesn't describe a way to appeal a single broker's result or file a targeted follow-up. The closest thing to a fix is entering more optional identifiers at signup, since a fuller profile improves the odds of a match (CalPrivacy, Aug. 25). An "opted out of sale" status means the broker still holds the record but can no longer sell or share it. A "record exempted" status means state law lets the broker keep what it found, whether that's all of the matched information or part of it; the status page doesn't spell out which exemption applies in a given case (CalPrivacy regulations, Nov. 2025).

When a broker does find a match and no exemption applies, the deletion requirement reaches further than a basic contact record. State regulations require the broker to delete all associated personal data, including inferences drawn from it (CalPrivacy regulations, Nov. 2025). That's a meaningfully broader obligation than scrubbing a name and phone number off a list.

The early results, reported by CalPrivacy on Aug. 25, are concrete: 99.9% of DROP users had at least one deletion reported, and the typical user's information had been removed by more than 40 brokers. At that same point, roughly 25% of the 654 registered brokers had reported processing requests (CalPrivacy, Aug. 25). The agency says brokers that don't comply face significant fines, and that enforcement action is possible against those that fall short (CalPrivacy, Aug. 25). Senator Josh Becker, who authored the Delete Act, framed the numbers this way: "The Delete Act is working exactly as intended by giving Californians real control over their personal information and holding data brokers accountable" (CalPrivacy, Aug. 25).

One submission is meant to hold. Brokers have to keep the data deleted even if they collect it again later, and they're required to maintain records to enforce that ongoing obligation (CalPrivacy, July 10 explainer).

DROP checks California residency before it does anything else, so the tool doesn't work for residents of other states (Gov. Newsom's office, Jan. 20).

That leaves the broker-by-broker process DROP was built to replace for Californians: contacting each company individually, a task that can take weeks to work through (CalPrivacy, Aug. 25). It's tedious, and for now it remains the main option for anyone outside California trying to delete personal data online from broker databases one at a time.

There's a federal angle worth watching, too. The Consumer Financial Protection Bureau opened a formal inquiry into data broker practices in 2023, gathering public comment on business models that fall outside older laws like the Fair Credit Reporting Act (Federal Register/CFPB, 2023). Whether that inquiry produces new rules, or a broader deletion right outside California, is still an open question. In the meantime, checking whether your own state has passed a privacy law with an opt-out or deletion right is the most useful next step, since California was among the first to legislate here, not necessarily the only one.

Registrations grew from about 155,000 as of Jan. 20 to more than 500,000 by Aug. 25 (Gov. Newsom's office; CalPrivacy). DROP only binds brokers registered with the state, and that roster can shift over time, so hold onto the eight-digit ID. Any status still marked pending will keep moving through the 45-day reporting cycle described above; check back rather than assume it's stuck.