Getting yourself off data-broker sites has always been the most tedious job in personal privacy. Dozens of companies hold a file on you — your address history, phone numbers, relatives, estimated income — and each one makes you find your own listing, submit its own opt-out form, and confirm by its own email, one at a time. Then you do it again next year. It’s a deliberate war of attrition, and the brokers win it by boring you into giving up.

California just changed that, and the date that matters is August 1, 2026.

What DROP actually is

The Delete Request and Opt-out Platform (DROP) is a free system run by the California Privacy Protection Agency. You submit one request, and it goes to every data broker registered in the state at once, instructing them to delete your personal information and stop selling or sharing it. No per-broker forms. No confirmation emails from companies you’ve never heard of.

It was created by the Delete Act (SB 362, signed in October 2023), and it’s the first system of its kind in the United States.

The platform has been accepting requests since January 1, 2026, but until now those requests have simply been queuing up. That’s what changes next week:

  • From August 1, 2026, every registered data broker must start retrieving and processing the requests waiting for them.
  • Brokers must check the platform at least once every 45 days from then on.
  • They must report the status of each request in DROP within 45 days of retrieving it.
  • Non-compliance carries a penalty of $200 per request, per day — the kind of number that makes ignoring it more expensive than complying.

If you already filed a request earlier this year, it hasn’t been forgotten. It’s in the queue, and it becomes enforceable next week.

How to use it

Go to the CPPA’s DROP page at privacy.ca.gov/drop and submit a request. You’ll provide your name, address, phone, and email — that’s for verification, so brokers can match your request against the file they hold on you.

Two details worth knowing:

  • You can file on behalf of someone else. If you have an elderly parent who’d never navigate a broker opt-out form, you can submit for them with an attestation. This is probably the highest-value ten minutes in this entire article.
  • It’s California residents only. The Delete Act is a state law, and DROP checks residency.

The honest limitations

This is a genuinely big deal, and it is not a magic eraser. Being straight about what it doesn’t do:

  • It only reaches registered data brokers. Companies that meet California’s data-broker definition must register with the state. Plenty of businesses that hold data about you — Google being the obvious example — aren’t classified as data brokers and are untouched by this.
  • Public records are excluded. Property ownership, vehicle records, and similar public filings stay public. DROP doesn’t reach them.
  • It stops the sale, but not the world. The request covers deletion plus opting out of sale and sharing. It isn’t a guarantee that no data about you will ever be collected again.
  • You’ll want to repeat it. New brokers register over time, and a request filed today doesn’t bind a company that registers next year. Treat it as an annual chore — but an annual chore that takes minutes instead of a weekend.
  • Several categories of business are exempt from the data-broker definition entirely, including entities covered by HIPAA, the FCRA, and the GLBA.

If you don’t live in California

You can’t use DROP. But two things are still true.

First, this is a template, and templates spread. California’s privacy laws have a strong track record of being copied — the CCPA is why you see “Do Not Sell My Personal Information” links on sites nationwide. A working, enforced, one-request deletion system is exactly the kind of thing other state legislatures point at and say “do that.” Watching how August goes is watching the pilot for a national norm. We’re tracking state privacy laws as they move.

Second, the manual route still works, and it’s worth the afternoon. Our guide to removing yourself from data brokers walks through the major brokers one at a time, in priority order, with the shortcuts that make it bearable. It’s the same outcome DROP automates — just done by hand.

What to do this week

If you’re in California: file the DROP request. It takes minutes, the enforcement deadline lands August 1, and there is no downside. Then file one for a relative who’d never do it themselves.

If you’re not: work through the data-broker guide, and use an email alias when you do — several opt-out forms ask for an address to “confirm,” and a few brokers are sketchy enough to treat that as a marketing signup.

Either way, the pattern here is the one worth internalising: the data-broker industry relies on the process being tedious enough that you quit. Anything that makes it less tedious — a state platform, a guide, an afternoon — is the whole game.