What happens when you tell 600 data brokers to delete your data?

How the request reaches the brokers

DROP stands for Delete Request and Opt-out Platform. It is a single website run by the California Privacy Protection Agency. You fill out one form. The system forwards that request to every data broker currently registered in the state — more than 600 of them. The brokers do not each build their own portal. They log into DROP, pull the list of new requests, and process them. Starting August 1, 2026, every registered broker must access DROP at least once every 45 days to begin work on pending deletions. The agency does not guarantee that all 600 will act on the same day. It could take up to 90 days before the status column in your DROP account shows any change. Timing varies by broker.

What you need to prove

Only California residents can submit a request. Verification happens through the California Identity Gateway, the state's secure digital identity platform. You do not need to create a Gateway account. You enter basic information directly or sign in with an existing Login.gov account. The agency suggests Login.gov only if you already have one. The information you provide is not retained by DROP after verification.

What you choose to share

You decide how much detail to include in the profile. Brokers need only enough to locate the records they hold about you. You provide basic information such as your name, address, phone number, or email. You can also submit on behalf of another California resident — a parent for a child, a relative for an elderly family member. The option is described in the eligibility guide.

When the brokers actually have to act

The timeline is fixed by regulation. January 1, 2026: DROP opens for submissions. August 1, 2026: brokers begin the mandatory 45-day check-in cycle. November 2026: the agency expects every broker in the registry to have completed at least one full download and upload round. After that point, deletion cycles repeat every 45 days. The platform shows status updates. The agency states that results vary by consumer and take time to notice. If a broker has already sold your data to a third party, the Delete Act does not automatically reach that third party. The law covers the registered brokers themselves. What happens downstream is not addressed in the platform description.

What changes for the person who submits

Data brokers collect a wide range of personal information. The list includes Social Security numbers, data about children, search history, and more. Removing that data from broker inventories can reduce unwanted texts, calls, and emails. It can lower the risk of identity theft and targeted fraud. The agency cautions that deletion can affect certain online experiences. For example, you can see fewer targeted ads or less personalized content. The platform does not promise a specific reduction in spam or a measurable drop in fraud attempts. It states only that limiting how your data gets sold can reduce volume. The service is free. The agency says it will never charge for use. Your information is used only to complete the request. It is not sold or shared for any other reason.