California Launches DROP Tool for Easier Data Deletion

California residents now have a powerful new tool to reclaim control over their personal data. The state has launched the Delete Requests and Opt-Out Platform (DROP), designed to significantly simplify the process of demanding data brokers delete stored and sold personal information. This initiative aims to bolster consumer privacy rights across the state, making it easier than ever for individuals to manage their digital footprint.

Background on Data Privacy Rights

Prior to this development, Californians possessed the right to request companies cease collecting and selling their data, a right established in 2020. However, exercising this right involved a cumbersome, company-by-company opt-out process. Recognizing this challenge, the Delete Act, enacted in 2023, sought to streamline this by enabling residents to make a single request to compel over 500 registered data brokers to delete their consumer information. The DROP platform now brings this promise to fruition.

How the DROP Platform Works

The Delete Requests and Opt-Out Platform (DROP) is the practical implementation of this landmark legislation. After verifying their California residency, users can submit a single deletion request through DROP. This request is then automatically forwarded to all current and future data brokers registered within the state, centralizing a previously fragmented and time-consuming process. This automation is a significant step forward in consumer data protection.

Key Details and Exemptions

It's important to note that immediate data deletion for all information isn't guaranteed. Data brokers are mandated to begin processing these requests in August 2026, with a 90-day window to complete the deletion and report back. Should a broker fail to delete specific data, residents will have the option to provide further information to aid in locating their records.

The new mandate specifically targets data brokers—entities that buy and sell personal information, which can include sensitive details like Social Security numbers, browsing history, email addresses, and phone numbers. Companies that collect "first-party data" directly from users are permitted to retain it. Additionally, certain public records, such as vehicle registration and voter information, are exempt from deletion. Other sensitive information, like medical data, falls under separate regulations such as HIPAA.

Benefits and Penalties

The California Privacy Protection Agency (CPPA) highlights several significant benefits of the DROP platform. Beyond empowering residents with greater control over their digital footprint, the tool is expected to reduce unwanted communications like texts, calls, and emails. Furthermore, it aims to significantly decrease the risk of identity theft, fraud, AI impersonations, and data breaches, thereby enhancing overall digital security for Californians.

To ensure compliance, data brokers who fail to register or neglect to delete requested consumer data face a penalty of $200 per day, in addition to enforcement costs, as stipulated by the CPPA. This robust enforcement mechanism underscores California's commitment to protecting its residents' privacy in the digital age.