California launches tool to simplify data broker deletion requests

The California Privacy Protection Agency (CPPA), the state regulator responsible for privacy enforcement, has officially launched the Delete Requests and Opt-Out Platform (DROP). This new tool should help California residents limit the ability of data brokers—defined as companies that collect and sell personal information—to store and sell their personal data. Through DROP, residents can now submit a single, centralized request to demand that more than 500 registered data brokers delete their personal information. This centralized approach replaces a task that previously required individual opt-outs for each company.

While California residents have held the legal right to demand that companies stop collecting and selling their data since 2020, exercising this right has historically been a manual and laborious process. To opt out, individuals had to contact each company one by one. The new platform stems from the Delete Act, which was passed in 2023 to streamline this process by establishing a legislative mandate to create a centralized, single-request mechanism for consumers.

Under the established timeline, registered data brokers are supposed to start processing these deletion requests in August 2026. Once a request is submitted through the platform, brokers are given a 90-day window to complete the deletion of the consumer’s data and report back to the system. To ensure compliance, the CPPA has established financial penalties. According to the agency, the penalty for data brokers that fail to register with the state or fail to delete requested consumer data is $200 per day, plus enforcement costs.

The CPPA notes that the tool is intended to give residents more control over their personal information. In launching the platform, the agency specifically highlighted the safety benefits of reducing the volume of personal data held by third parties. The regulator cited the need to protect California residents from the risk of identity theft, fraud, AI impersonations, or that your data is leaked or hacked.

Why it matters

The launch of DROP shifts the burden of privacy management from the individual to a centralized state system, significantly lowering the friction for residents to reclaim their personal data from the opaque data broker ecosystem.