On 1 August 2026, a new obligation lands on registered California data brokers: they must start retrieving and processing consumer deletion requests submitted through the state's own platform, DROP. It is free, it is official, and if you are a Californian you should use it. This page explains what it is, how to file, and — because honesty about limits is the whole point of this publication — what a DROP request genuinely covers and what it does not.
We'll say the second part plainly, because most coverage won't: DROP is a strong tool with a defined boundary. It reaches the brokers that registered with California. It does not reach the ones that didn't, the people-search sites operating outside the registry, or anything beyond California's jurisdiction. Knowing where the boundary sits is the difference between feeling protected and being protected.
California's Delete Act (SB 362, signed in 2023) did two things. First, it tightened the state's existing data broker registry: companies that meet California's definition of a data broker must register with the California Privacy Protection Agency (CPPA) and disclose what they collect. Second — the ambitious part — it ordered the CPPA to build a single deletion mechanism: one request, filed once with the state, that every registered broker must honour.
That mechanism is DROP — the Delete Request and Opt-out Platform. Consumers have been able to file requests into it since the start of 2026. What changes on 1 August 2026 is the other half of the loop: from that date, registered brokers are required to access the platform, retrieve the queue of requests, and process them — and then keep coming back for new requests on a recurring statutory cycle, every 45 days, so a request filed after launch day is picked up on the next cycle rather than lost. Deletion under DROP is not a one-off, either: brokers must continue honouring the request as they acquire new data, which matters because re-collection is how listings come back.
In short: before August, DROP was a mailbox brokers didn't have to open. From August, opening it is the law — for the brokers the law names.
You do not need a company — ours or anyone's — to do this. If you are a California resident, the state's own channel is free and takes a few minutes:
That's the whole process. It costs nothing, and for the brokers it reaches it carries something no private company's request carries: the direct force of California law, enforced by the regulator that runs the platform.
A DROP request reaches data brokers registered with the State of California. That registry is public — the CPPA publishes it — and it includes many of the large, well-known US brokers. For the brokers it reaches, DROP is now the strongest single deletion channel in the United States: statutory, free, recurring, and audited by the state itself.
If you are a Californian, that is real coverage, and you should claim it.
This is the section the launch-week coverage will mostly skip.
None of this is a criticism of DROP. A state platform that compels the registered layer is a genuinely good thing, and it will be copied. But "the registered California layer" is one stratum of the trade, and the trade's whole business model is the unregistered, re-listing, jurisdiction-hopping remainder.
We are not a substitute for DROP, and we won't pretend to be. If you are a Californian, file your DROP request; it is free and it is yours.
What we do sits around and beyond it. We scan the sites that publish people — including the ones no registry compels — and show you what we found, what we couldn't check, and the difference between the two. We send removal requests to the sites that expose you, in writing, and we keep the dated evidence of every request and every response: what was sent, when, what came back, and what changed. Where a listing comes back, our re-scans are how you find out. We show you exactly what happened — per listing, with dates — rather than asking you to take an aggregate on trust.
Two honest notes on our own California posture. We have written to the CPPA asking, in writing, what it requires of authorised agents who submit DROP requests on consumers' behalf — what proof of authorisation, what identity verification, what records. We would rather build to the regulator's stated requirements than to our own reading of them, so until that answer arrives, our work runs through our existing channel: written requests and dated evidence, direct to the sites that publish you. And where DROP is simply the better tool for a given broker — free, statutory, state-run — we will tell you so, the way this page just did.