A privacy right becomes more useful when people have a practical way to exercise it. California’s Delete Request and Opt-out Platform, known as DROP, is a new example: eligible residents can submit one deletion request that reaches hundreds of registered data brokers. The service is free. CalPrivacy’s official overview explains who can participate.

The development is worth understanding even if you live elsewhere. It shows how a privacy law can move from a promise on paper to a process people can actually use. It also illustrates why careful explanations matter: eligibility, timing, and exceptions all affect what a deletion request can accomplish.

What changed in 2026

California’s legislature passed the Delete Act in 2023. Regulations governing the deletion mechanism took effect on January 1, 2026, after the rulemaking was completed in 2025. The agency’s rulemaking page confirms those dates. DROP opened to consumer requests in January 2026, and data brokers’ processing obligations began on August 1, 2026. As of this article’s publication, that processing requirement is in effect. The official timeline separates the consumer launch from the start of broker processing.

This distinction matters when reading privacy headlines. The passage of a law, the launch of a public service, and the start of an obligation can happen at different times. Knowing which milestone has occurred helps people form realistic expectations.

Why data brokers are part of the conversation

CalPrivacy describes data brokers as businesses that gather and sell consumer information obtained outside a direct relationship with the person. That information can include contact details, browsing history, interests, and other personal information. Brokers may also develop inferences about people from the records they hold. The agency’s explanation of data brokers provides more detail.

For a consumer, a central request process offers a more manageable starting point than trying to identify every organization that might hold information about them. In my view, making that process easier to find and understand is an important part of effective privacy policy.

Who can use DROP, and how long it takes

DROP is available to California residents, and the process includes residency verification. People in other states should check the rights and tools available under the laws that apply to them. California’s eligibility rules should not be assumed to apply nationwide. CalPrivacy sets out the eligibility requirements here.

Beginning August 1, brokers must retrieve requests at least every 45 days. When a request matches their records, they must delete associated personal information unless an exemption applies, and report a status within 45 days of retrieving the request. CalPrivacy’s regulations announcement explains those duties. The consumer instructions say status updates can take up to 90 days. After initial processing, brokers must continue checking for and deleting new matching data at least every 45 days.

A deletion request has limits

DROP does not erase every trace of someone’s life from the internet. Publicly available information and legally exempt records can remain. Information a person supplied directly to a business is also treated differently from information that business obtained as a data broker. A separate privacy request may be relevant for directly supplied information. CalPrivacy explains exemptions and partial deletions so consumers can understand those boundaries.

Results can differ between brokers. Some may locate matching records; others may report that no matching record was found. A status report should be read for what it actually says. It is useful feedback about a particular request, rather than proof that every organization has removed every piece of information.

Turning awareness into a practical step

Eligible residents can start at the official DROP website, review its instructions, and decide what identifying information to provide. The process supplies an eight-digit DROP ID for checking status; the agency advises saving it and keeping it private. Additional information can be added to a profile later, which may help brokers find matching records. The step-by-step guide explains the process.

To me, the broader lesson is that privacy advocacy should help make rights understandable and usable. Clear instructions, realistic expectations, and accessible tools give people a better opportunity to take part in decisions about their information. Following how this process works in practice is a useful way to keep that conversation grounded in people’s everyday needs.

General information for education and awareness, not legal advice. Legal rights depend on the applicable law and circumstances. Sources reviewed September 6, 2026.

Explore privacy articles