Your Privacy Rights
The California Delete Act, Explained Simply
The short version
The California Delete Act is Senate Bill 362, signed in October 2023. It does two things: it forces data brokers to register with the state every year, and it created DROP, a free platform where a California resident files one deletion request that reaches every registered broker at once. Consumers have been able to sign up since January 1, 2026. The date that makes it real is August 1, 2026, when brokers must start pulling those requests and deleting. It is a standing order, not a one-time cleanup - but it only covers registered brokers, and only for Californians.
What the Delete Act actually is
The California Delete Act is a state law, Senate Bill 362, that the governor approved on October 10, 2023. It requires companies that collect and sell personal information about people they have no relationship with to register with the state each year, and to honor deletion requests sent through one free government platform.
That platform is DROP, short for the Delete Request and Opt-out Platform. It is run by the California Privacy Protection Agency, which now goes by CalPrivacy. The law did not invent a new privacy right so much as fix a distribution problem: Californians already had a deletion right under the CCPA, but exercising it meant filing hundreds of separate requests. The Delete Act turned that into one form.
Why California bothered
Before the Delete Act, the only way to get off people-search sites and data brokers was to find each one, locate your listing, and file its own opt-out. That is dozens of hours of unpaid clerical work, repeated every few months, and almost nobody finished it. The right existed on paper and died in practice.
The state also had no reliable census of the industry. Registration solved that half. As of CalPrivacy's June 2026 update, 581 data brokers were on the register, the highest count on record, and the agency has said the true number operating is higher than the registry shows.
What DROP does that an opt-out form does not
One DROP request is transmitted to every registered data broker at once. Instead of you chasing 500 companies, the companies are legally required to come to the platform and collect your request. That single change is what makes the Delete Act different from every other US privacy law currently on the books.
The second difference is duration. Under Civil Code section 1798.99.86, a broker that receives your request must keep deleting your information at least once every 45 days, and must not sell or share new personal information about you unless you ask it to. Most opt-out forms suppress one listing on one day. DROP is a standing instruction that keeps running.
How to sign up, step by step
Signing up takes about ten minutes and costs nothing. You accept the terms, prove you are a California resident, then list the identifiers you want brokers to match against. The one thing to get right is the verification step, because you cannot switch methods after you pick one.
- Verify residency. Two options: the California Identity Gateway, which checks details like your phone, email, California address, or Social Security number against state records, or a Login.gov account, which needs photos of a government ID. The Gateway is usually faster; Login.gov is faster if you already have an account.
- List your identifiers. You can submit multiple versions of your name, up to three zip codes, up to three email addresses, up to three phone numbers, advertising IDs from your phone and smart TV, and vehicle identification numbers.
- Confirm contact details. Emails and phone numbers are verified with single-use codes before the request goes through.
Our step-by-step California DROP guide walks through each screen if you want to see what you are signing up for first.
The dates that matter
The Delete Act rolls out in stages, which is why it has felt slow. The law passed in 2023, the platform opened in 2026, and broker obligations start this August. Audits do not begin until 2028. Here is the whole timeline in one place.
| Date | What happens |
|---|---|
| October 10, 2023 | SB 362 signed into law |
| January 1, 2026 | Deadline for the state to launch DROP; consumer sign-ups open |
| January 1-31, each year | Annual data broker registration window |
| August 1, 2026 | Brokers must start retrieving and processing DROP requests |
| Every 45 days after | Brokers must re-access DROP and delete again |
| January 1, 2028 | First mandatory third-party compliance audits, then every 3 years |
Source: California SB 362 (2023) and the California Privacy Protection Agency's data broker guidance.
What changes on August 1, 2026
August 1 is the switch from voluntary to mandatory. Registered brokers must access DROP, pull the queue of deletion requests, delete the matching personal information held by them and by their service providers and contractors, and report the status of each request back through the platform within 45 days of retrieving it.
There is a backlog waiting. CalPrivacy figures reported in July 2026 put DROP sign-ups at 322,292 as of July 1 - still under one percent of California's population, but a large first batch. Executive Director Tom Kemp has said people who signed up by August 1 should start seeing results by late October, once the first 45-day cycles complete.
What the Delete Act does not cover
This is the part worth being blunt about, because the gap between "delete my data everywhere" and what DROP actually does is wide. DROP reaches registered data brokers. It does not reach anyone else, and a broker can lawfully keep some data even after your request.
- Companies you have a relationship with. Your bank, retailer, and employer are not data brokers under this law.
- Search engines and social networks. Google and Facebook are not covered by DROP.
- Unregistered sites. If a broker never registered, your request never reaches it - which is why registration enforcement matters so much.
- Regulated data. Information covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or HIPAA is carved out, along with data a broker is legally required to retain.
One useful detail: if a broker cannot verify that a request is really yours, it does not get to ignore it. The statute requires it to process the request as an opt-out of the sale or sharing of your information instead.
What it costs brokers to ignore the law
The penalties are per-day and they compound, which is unusual for privacy law. Failing to register costs $200 for every day the broker is late. Failing to delete costs $200 per deletion request per day, plus the agency's investigation and enforcement expenses. Registration itself costs $6,000 for 2026.
These are not theoretical. CalPrivacy runs a Data Broker Enforcement Strike Force and has already settled several cases for registration failures alone, before the deletion duty even starts.
| Company | Fine | Announced |
|---|---|---|
| Accurate Append, Inc. | $55,400 | July 29, 2025 |
| Rickenbacher Data LLC (Datamasters) | $45,000 | January 8, 2026 |
| S&P Global, Inc. | $62,600 | January 8, 2026 |
Source: California Privacy Protection Agency enforcement announcements, July 29, 2025 and January 8, 2026. All three were failure-to-register cases.
The Datamasters case shows what the registry is for. CalPrivacy said the company resold names, addresses, phone numbers, and emails of millions of people with serious health conditions, and ordered it to stop selling Californians' data entirely. Enforcement head Michael Macko put it plainly: "Reselling lists of people battling Alzheimer's disease is a recipe for trouble."
If you do not live in California
You cannot use DROP, and no other state has built an equivalent yet. What you do have is the same underlying right in a growing number of states, exercised one company at a time, plus the free opt-out that every major people-search site already offers regardless of where you live.
That is slower, but it is not hopeless, and the biggest brokers account for most of your visibility in search results. We cover the non-California route in what to do if you are not in California, and the state-by-state picture in your data deletion rights by state.
What to do about it this week
If you are a Californian, sign up for DROP before August 1 so your request is in the first batch brokers must process. It is free, it takes about ten minutes, and it keeps working every 45 days after that. Then treat it as a floor, not a ceiling.
DROP will not touch the sites that never registered, so it is worth knowing which ones list you. A free exposure scan shows the brokers most likely to carry a US adult's details plus any breaches tied to your email, and nothing you type is stored. If you are weighing DROP against paying someone, we compared them directly in DROP vs paid removal services, and the opt-out guide library covers 57 major brokers by hand.
Find out who has your data
Run a free exposure scan to see which data brokers likely list you, plus any breaches tied to your email. No account, nothing stored.
Frequently asked questions
What is the California Delete Act in one sentence?
It is Senate Bill 362, signed on October 10, 2023, which requires data brokers to register with the state of California every year and to delete a resident's personal information when that resident asks through a single free state-run platform called DROP.
Who can use DROP?
California residents only. You are eligible if you live in California or are domiciled there, even if you are temporarily outside the state. There is no equivalent single-request platform in any other state yet.
Does DROP cost anything?
No. DROP is free for consumers. The costs fall on data brokers, who pay an annual registration fee to the state - $6,000 for 2026, plus a payment processing fee - and who bear the cost of processing deletion requests.
What actually happens on August 1, 2026?
That is the date registered data brokers must begin retrieving deletion requests from DROP. From then on they have to check the platform at least once every 45 days, delete the matching personal information, and report the status of each request back through DROP.
Is a DROP request a one-time deletion?
No, and this is the part most people miss. Under Civil Code section 1798.99.86 a broker must keep deleting your information at least once every 45 days and must not sell or share new personal information about you unless you ask it to. A DROP request is a standing order, not a single cleanup.
Does DROP remove me from Google, Facebook, or sites I signed up for?
No. DROP only reaches businesses registered as data brokers in California. It does not cover search engines, social networks, or any company you have a direct relationship with, and it does not cover data governed by the FCRA, GLBA, or HIPAA.
What happens if a data broker ignores the Delete Act?
The penalty is $200 per day for failing to register, and $200 per deletion request per day for failing to delete, plus the agency's investigation costs. CalPrivacy has already collected fines including $55,400 from Accurate Append and $62,600 from S&P Global for registration failures alone.
What can I do if I do not live in California?
You cannot use DROP, but most large brokers offer a free opt-out to anyone, and a growing number of states give you a deletion right you can exercise company by company. The manual route is slower but it is open to everyone.
Sources: California SB 362 and Civil Code section 1798.99.86 (leginfo.legislature.ca.gov); the California Privacy Protection Agency's data broker and DROP pages, its June 2026 registration update, and its enforcement announcements of July 29, 2025 and January 8, 2026; Government Technology, July 13, 2026; The Markup, January 8, 2026.