California residents can use new tool to demand brokers delete their personal data

California Launches Tool to Help Residents Control Data Broker Information

California residents now have a new tool at their disposal to better manage the storage and sale of their personal information by data brokers. The state has introduced the Delete Requests and Opt-Out Platform (DROP) to streamline the process of requesting data deletion from over 500 registered data brokers.

Previously, residents had the right to opt out of data collection and sales by individual companies, but it was a cumbersome process. The Delete Act, passed in 2023, aimed to simplify this by allowing residents to submit a single request through DROP, which would then be sent to all relevant data brokers.

With DROP, California residents can verify their residency and submit a deletion request that will be distributed to all current and future registered data brokers in the state. However, the process of data deletion may not happen immediately. Brokers are required to start processing requests in August 2026 and have 90 days to complete the deletion and provide a report. If data is not deleted, users can provide additional information to assist in locating their records.

It’s important to note that companies can retain first-party data collected directly from users. The deletion requirement applies only to data brokers that buy or sell personal information such as social security numbers, browsing history, email addresses, and phone numbers. Certain information, like vehicle registration and voter records, is exempt from deletion as it is derived from public documents, while sensitive medical information may be protected under other laws like HIPAA.

The California Privacy Protection Agency emphasizes that DROP gives residents more control over their data and reduces the risk of identity theft, fraud, and data breaches. By using this tool, users may experience fewer unwanted communications and potential security threats.

The California Privacy Protection Agency enforces penalties for data brokers who fail to register or comply with deletion requests. Violators may face a fine of $200 per day, in addition to enforcement costs.