Since January 1, 2026, a resident of California has been able to fill in one form and have every broker on the state's registry told to erase whatever it holds about them. The form belongs to DROP, short for Delete Request and Opt-out Platform, which the California Privacy Protection Agency runs under the Delete Act of 2023, written by state Senator Josh Becker. Brokers were required to start acting on the requests on August 1, 2026, and must check the platform at least once every 45 days.
By August 25, 2026 more than 500,000 Californians had registered and 654 data brokers were in the system, up from 581 in early June. The stakes for brokers are concrete: a fine of $200 per deletion request for every day it goes unprocessed, and from January 1, 2028 an independent audit every three years.
Who counts as a data broker
The statutory test is short: a business is a broker if it knowingly collects personal information about consumers it has no direct relationship with and sells it to third parties. Companies covered by the federal credit reporting, financial privacy or health privacy laws, or by California's insurance privacy act, are carved out to that extent. Regulations adopted in 2025 add that collecting data straight from a person does not create a direct relationship unless the person intended to deal with that business, so an analytics kit embedded in someone else's app can still be a broker.
Brokers must register with the agency by January 31 each year and pay a fee, $6,000 for 2026 and $9,500 for 2027 after a board vote in August. A 2025 amendment, SB 361, signed on October 8, 2025, expanded the registration form: brokers must state whether they collect government identification numbers, biometric data, immigration status, union membership, sexual orientation or reproductive health data, and whether in the past year they sold or shared data with a foreign adversary government or a company based in such a country, the federal government, other states, law enforcement or a developer of generative AI systems. The same amendment doubled the daily fine for failing to register from $100 to $200.
How a request moves through the system
A consumer starts by proving California residency through the state's identity gateway. The request needs only a name, a birth date and a ZIP code, but it can carry more: additional names, email addresses, phone numbers, mobile advertising identifiers, connected TV identifiers and vehicle identification numbers. The consumer receives an eight digit DROP ID to check status later, can exclude particular brokers, and can file on behalf of a child or an elderly relative. The service is free.
The platform never hands brokers raw personal data. They download lists of hashed identifiers, hash their own records the same way and look for matches. Where one is found they must delete everything they hold on that person, including inferences, within 45 days, and report an outcome: deleted, exempted, record not found, or opted out. Opted out means the broker could not verify a match and may keep the data but no longer sell or share it. Brokers must repeat the matching at least every 45 days so that newly acquired data about the same person is removed, and may not contact the consumer directly about the request.
Not everything goes. Information a person gave a company directly, as a customer or account holder, is first party data and outside the request. Publicly available information stays, and brokers may keep records they are legally required or permitted to retain, but may use them for nothing else. Consumers were told to expect up to 90 days before a status changed from pending.
Penalties, audits and the early numbers
A broker that fails to register owes $200 for each day of the lapse; one that fails to delete as required owes $200 per deletion request per day. From January 1, 2028, and every three years after that, each broker must commission an independent audit of its compliance, and from January 1, 2029 its annual registration must say whether the audit has happened. The agency opened rulemaking on the audit rules at its board meeting on August 7, 2026, with a draft that has auditors test hashing, matching and deletion logs rather than rely on attestations.
Take up has outrun the agency's expectations. It counted 18,000 requests in the first 48 hours and more than 242,000 by its board meeting on February 27, 2026, then over 300,000 sign ups by June 2 and half a million registered users by August 25. On that date the agency also said that about 25 percent of brokers had reported processing requests since the August 1 deadline, and that 99.9 percent of registered consumers had been deleted by at least one broker, the typical user by more than 40. Enforcement began the same month, with decisions against brokers on August 11 and 13, an action against a Virginia based broker on September 1, and a September 3 advisory on incorrect registration information.
Those early figures say the matching works at least once for nearly everyone, not that every broker has found every record. The matching is only as good as the identifiers a person supplies and the care with which a broker hashes its own files, and the statute lets a consumer amend a request once 45 days have passed. For anyone whose status comes back as record not found, the agency's advice is to add an email address, a phone number or a mobile advertising ID and let the next 45 day cycle try again.
