trustifo

California / data broker control

One request to registered data brokers.

California’s Delete Request and Opt-out Platform—DROP—accepts a single resident request. Data brokers begin retrieving and processing request lists on August 1, 2026.

Direct answer: California residents can use the official DROP platform to send one deletion request to active registered data brokers. The platform launched for consumers on January 1, 2026; brokers must begin processing DROP requests on August 1, 2026.

What DROP changes

Ordinary broker removal is one company at a time. DROP creates an accessible deletion mechanism under the California Delete Act. A resident submits identifiers through the state platform, and the system transforms specified values so registered brokers can compare them with similarly transformed records. The California Privacy Protection Agency explains that the platform hashes submitted identifiers rather than distributing a resident’s raw values through the request lists.

DROP does not guarantee that every broker will find a match. A broker may report that it found no record, found an ambiguous partial match, or completed deletion, depending on the identifiers supplied and the information it maintains. Adding an optional identifier can improve matching, but the resident should still use the minimum information reasonably needed for the objective.

Consumer procedure

  1. Open the state-operated DROP site from privacy.ca.gov, not an advertisement or paid removal service.
  2. Complete California residency verification and create the request using identifiers you are comfortable providing to the state platform.
  3. Save the DROP ID. It is the control needed to return and review request status.
  4. Check results after brokers begin processing on August 1, 2026. A matched request is processed on the rolling schedule described by the Agency.
  5. Update the request if the status shows that a broker could not uniquely match the provided identifiers and you choose to add information.

Broker duties and timing

The CPPA states that beginning August 1, 2026, registered data brokers must access DROP at least once every 45 calendar days. They download the relevant deletion lists, standardize and hash comparable records, match requests, process required deletions, and report status. When a match is established, the obligation extends to associated personal information and inferences, subject to statutory exceptions.

The system is designed for ongoing suppression as well as an initial delete action. The Agency’s materials explain that brokers must maintain information needed to keep covered data deleted rather than simply reacquiring and reselling it. Failure to process a consumer request can expose a broker to statutory administrative consequences; consult the CPPA’s broker guidance for the current language and implementation materials.

What DROP does not cover

The data-broker definition contains exclusions, including specified activity covered by laws such as the FCRA and GLBA. DROP is also directed at information obtained in the broker relationship described by the statute. If a business collected information directly from a person as a customer, that information may require a separate request through the business’s own channel.

Use individual Trustifo removal guides when a direct request is still useful, when you are outside California, or when a record needs attention before the DROP cycle. Read data broker and suppression list for the key operational concepts.

Evidence and follow-up

Keep the DROP ID private. Record when the request was submitted and when each status changed. If a broker reports no match but its public search still displays a record, compare the identifiers without posting the result publicly. The discrepancy may reflect spelling, a former contact point, an affiliate, or a record that is not part of the broker’s DROP-matching set.

Reviewed July 26, 2026. Primary sources: CalPrivacy DROP, CPPA processing explainer, and information for data brokers. Informational only.