Since January, Californians have been able to file one request that tells every registered data broker in the state: delete everything you have on me. The catch? Until last Friday, brokers didn't actually have to do anything about it.
That grace period is over. As of August 1, the delete button is connected to real penalties — and they're brutal.
What DROP is, in plain terms
DROP — the Delete Request and Opt-Out Platform — comes from California's Delete Act (SB 362) and is run by the state's privacy agency, CalPrivacy. Instead of hunting down hundreds of data brokers one by one and filing separate requests with each, you file once at the state's site. Every broker registered in California has to check the system and act on what's there.
Data brokers, if you've never had the pleasure: companies that collect and sell your name, address, phone number, purchase history, location patterns, and inferences about you — usually without you ever knowing they exist. California has forced them to register since January, which is exactly what makes a one-stop deletion system possible.
What changed August 1
Three obligations kicked in. Brokers must now log into DROP at least every 45 days to pull new requests. They must process each request within 45 days of receiving it. And they must delete what they hold on you — including the inferences they've derived, not just the raw records — then report status back.
The enforcement math is what makes this more than a polite suggestion: $200 per unfulfilled request, per day. One analysis ran the numbers on a broker ignoring 50,000 deletion requests — that's a $10 million exposure for every day of noncompliance. Fines like that turn "we'll get to it" into an existential risk.
What it doesn't do
Honest limits, so you're not surprised. It covers brokers registered in California, not every company with your data — your bank, your apps, and social platforms are governed by other rules. It's built for California residents. And deletion isn't a force field: brokers can collect data again going forward, which is why the system is designed for recurring cleanup rather than one glorious purge.
If you're in California, here's your move
Head to the DROP portal on privacy.ca.gov and submit a deletion request — it's free, and it's one form. Mark a calendar check about 45–90 days out, when brokers are required to have processed and reported. And make it a habit: file again periodically so re-collected data gets swept too.
Not in California? This still matters. State privacy laws have a habit of spreading — and every broker that builds a deletion pipeline for California now has infrastructure the other 49 states can point at and say: them too.
For twenty years, the data broker economy ran on one assumption — that deleting yourself was too tedious to bother. As of Friday, in one state, it's one form and a waiting period. Tedium just switched sides.
Image: cottonbro studio, via Pexels
