Section: Data rights · Last updated: October 26, 2026
This guide is based on the California Privacy Protection Agency’s data broker page and the Agency’s regulations on data broker registration and the accessible deletion mechanism (Cal. Code Regs., tit. 11, §§ 7600–7622, effective January 1, 2026). It is general information, not legal advice.
California’s Delete Act (SB 362) required the state privacy agency to build one place where a resident can ask every registered data broker to delete their personal information with a single request. That system is the Delete Request and Opt-out Platform (DROP). Since August 1, 2026, data brokers must pull the request lists from DROP at least once every 45 days and process them.
1. Who counts as a data broker
The Agency’s page explains that a business is a data broker when it knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship (Civ. Code § 1798.99.80(c)). Data brokers must register with the Agency every year between January 1 and 31, and the Agency publishes a Data Broker Registry.
The regulations add that a “direct relationship” means you intentionally interacted with the business to use or learn about its products or services. Contacting a company only to exercise a privacy right, or to verify your identity, does not create one (§ 7601(d)).
2. What you do as a consumer
| Step | What the regulation says | Section |
|---|---|---|
| Residency check | The Agency verifies California residency before you can submit. If it cannot verify you, you cannot submit through DROP. | 7620(a) |
| If residency is not verified | You may ask for a review within 10 calendar days of the classification, with an explanation and an email or phone number. The Agency may ask for documents. | 7622 |
| Extra identifiers | You may add date of birth, email address, phone number and pseudonymous identifiers such as a Mobile Ad Identifier (MAID). | 7620(b) |
| Consent to share | Submitting means you consent to your information being disclosed to data brokers so they can process the deletion. | 7620(c) |
| Changing your mind | You may amend or cancel a request no sooner than 45 calendar days after submitting it. | 7620(d) |
| Using an agent | An authorized agent may help after your residency is verified; the agent’s name, email and trade name must be disclosed in your DROP account first. | 7621 |
Adding identifiers matters because brokers match on them. If a broker holds you only under an old email address or a phone number you did not enter, the list it downloads may not match your record.
3. What a data broker must do with your request
| Duty | Detail | Section |
|---|---|---|
| Check DROP | Download its consumer deletion lists at least once every 45 calendar days | 7612(a) |
| Match | Standardize its own records, hash them with the same algorithm as the list, and compare | 7613(a)(1) |
| Delete on a match | Delete all personal information tied to the matched identifier, including inferences | 7613(b)(1) |
| Several people match | Opt every matched consumer out of sale or sharing | 7613(a)(2)(B) |
| No match yet | Keep the list and compare newly collected records against it before selling or sharing them | 7613(c) |
| Service providers | Direct its service providers and contractors to delete as well | 7613(d) |
| Report back | Report a status for every request at the next access session | 7614 |
| No contact | Must not contact you to verify a request submitted through DROP | 7616(c) |
The four status codes a broker can report are:
- Record deleted: a match was found and the information was deleted.
- Record opted out of sale: several consumers matched the identifier, so all of them were opted out of sale or sharing.
- Record exempted: a match was found, but all of the information falls under a legal exemption.
- Record not found: no match in the broker’s records.
4. What DROP does not cover
- Companies you deal with directly. A broker is not required to delete information it collected directly from you as a “first party” (§ 7613(b)(1)(A)). For an app, shop or service you use, send a deletion request to that company under the CCPA right to delete (Civ. Code § 1798.105).
- Exempt information. Information exempt under Civ. Code § 1798.99.86 does not have to be deleted (§ 7613(b)(1)(A)).
- Backups, for now. Deletion from archived or backup systems may wait until that system is restored to active use or accessed for a sale, disclosure or other commercial purpose (§ 7613(b)(1)(C)(i)).
- A minimal record stays. The broker keeps the minimum information needed to keep honoring your request, and may not use it for anything else (§ 7613(b)(1)(B)).
FAQ
Q. How soon will brokers act after I submit?
Brokers must pull the lists at least every 45 calendar days, and requests are processed when they do. The regulations tie the timing to those access sessions, not to a fixed number of days from your submission.
Q. Do I need to send one request per broker?
No. One request through DROP reaches every registered data broker; the Agency describes it as a single verifiable request directed to each of them.
Q. Can I use DROP if I live outside California?
The Agency verifies California residency before a request can be submitted (§ 7620(a)), so non-residents cannot submit through DROP.
Q. Will a broker email me to confirm?
It should not. § 7616(c) says a data broker shall not contact a consumer to verify a deletion request submitted through DROP, so treat such messages with care.
Official sources
- California Privacy Protection Agency (cppa.ca.gov) — Information for Data Brokers and the Data Broker Registry
- California Privacy Protection Agency — Text of Regulations: Data Broker Registration and Accessible Deletion Mechanism (effective Jan. 1, 2026)
- California Legislative Information — SB 362 (2023), the Delete Act; Civil Code § 1798.99.80 and following, and § 1798.105
- The Agency’s DROP page for consumers (privacy.ca.gov/drop)
This article is general information and not legal advice. Check the Agency’s current pages before relying on any date or step, as procedures may be updated.