California’s data-broker deletion deadline passes: what 500,000 residents asked to have erased

California has reached the first big test of its plan to let residents wipe their personal details from the data-broker industry in one move. On Friday 30 October 2026, the deadline passed for data brokers to delete the personal information covered by the first wave of requests sent through the state’s Delete Request and Opt-out Platform, known as DROP. The milestone turns a right that existed on paper into something brokers actually had to do — and it arrives with more than half a million Californians already signed up.

Data brokers are companies that collect personal details about people — names, addresses, phone numbers, buying habits, location history and more — and sell them to other businesses. Most people have never heard of the brokers holding their information, let alone contacted them. California’s answer was a single, free government tool that sends one deletion request to every registered broker at once. The 30 October deadline was the moment the first batch of those requests had to be acted on.

At a glance

What happened: On Friday 30 October 2026, California’s first deadline passed for data brokers to delete personal information requested through DROP, the state’s Delete Request and Opt-out Platform, for requests submitted before 1 August 2026.

Why it matters: More than 550,000 Californians have signed up for DROP, and early figures from the state’s privacy agency show 99 per cent of users had their information deleted by at least one data broker. It is the first system of its kind in the United States.

What happens next: Brokers must keep checking DROP at least once every 45 days and delete newly found records. From 1 January 2027, they will have to process requests at least once every 30 days, and brokers that ignore requests face fines of $200 per day, per request.

What DROP is, and why California built it

DROP is a free online service run by the California Privacy Protection Agency, known as CalPrivacy. It was created under California’s Delete Act, a law passed in 2023 that forces data brokers to register with the state and gives residents a single way to ask them all to delete their personal information.

Before DROP, a Californian who wanted their details removed from data brokers had to find each broker, work out how to contact them, and send a separate request to every one — a job so long and confusing that almost nobody did it. DROP replaces that with one form. A resident verifies that they live in California, enters the identifying details brokers are likely to hold, such as their name, address, email and phone number, and submits a single request. The platform then sends that request to every registered data broker in the state.

Digital Watch, which reported the deadline on 31 October, says the service covers more than 600 registered data brokers. The platform protects the details residents submit by converting them into scrambled codes, a process called hashing, and brokers convert their own records the same way so the two sets of codes can be compared. Each person who submits a request gets a DROP ID to track its status online.

Under the law, a data broker is a business that knowingly collects and sells the personal information of a consumer with whom it does not have a direct relationship. That definition is wider than many people expect: it can include companies selling information they did not collect directly, or about customers who have not interacted with them for three years.

How the deadline worked

DROP opened for residents to submit requests on 1 January 2026. For the first seven months, the requests piled up while brokers set up their accounts and systems. Brokers were required to start processing the requests on 1 August 2026. The first batch — every valid request submitted before 1 August — then had a 90-day window, which ended on Friday 30 October 2026.

That date was the first time brokers had to show they had actually deleted the records, not just received the requests. The Electronic Privacy Information Centre, a privacy research group known as EPIC, highlighted the milestone in an article published on 30 October, and Digital Watch reported it the following day.

The take-up surprised even the people who built the system. EPIC reported that more than 500,000 Californians had submitted requests by 25 August 2026. By early October, a briefing published on 7 October 2026 put sign-ups at more than 550,000.

The numbers so far

CalPrivacy published updated figures on 6 October 2026, and they suggest the system is working for most of the people who have tried it. According to those figures, 99 per cent of consumers who used DROP had their information deleted by at least one data broker since processing began on 1 August, and 70 per cent had their information deleted by 100 or more data brokers.

Those figures come with an important warning, however. A deletion request does not always result in a deletion. For each request, a broker reports a status such as “deleted”, “exempt” or “record not found”. Some records are exempt under the law, and some brokers simply may not hold any record that matches the person who asked. Residents should also expect the process to take time: California’s guidance notes that status updates in DROP may take up to 90 days to appear.

What brokers have to delete — and what they can keep

When a broker receives a DROP request, it must delete the matching personal information unless a legal exemption applies. That includes not just the obvious details such as a name and address, but also inferences — the guesses and labels a broker has drawn about a person, for example about their health, finances or interests.

There are limits. Brokers do not have to delete information that falls under a legal exemption. According to CalPrivacy, exempt information commonly includes information that consumers provided to the data broker directly, and information that is publicly available. Certain public records are also exempt. The exact boundaries of what must be deleted and what can be retained are still not fully settled.

The obligation does not end once the first deletion is done. Brokers must recheck their records at least every 45 days and delete any newly obtained information about people who have submitted requests. CalPrivacy’s guidance says brokers should keep a list of the consumers who submitted requests — often called a suppression list — so new records can be screened against it before any sale or sharing. Brokers must also pass the instruction on to their service providers and contractors, so the deletion reaches the companies that process data on the broker’s behalf.

What happens to brokers that ignore a request

The Delete Act carries real penalties. A broker that fails to register faces a fine of $200 per day, plus CalPrivacy’s cost of investigation and administrative action. A broker that fails to process a deletion request faces a fine of $200 per day for each unprocessed request, for as long as the personal information remains undeleted, again plus the agency’s costs.

That per-request fine can grow very fast. With hundreds of thousands of residents signed up, a broker that ignored a large batch of requests could face penalties running into millions of dollars a day. The annual registration fee for brokers is $6,000, plus a processing charge for electronic payments, and registration must be completed by 31 January each year.

CalPrivacy has already shown it will use its enforcement powers. In January 2026, a company called Datamasters paid $45,000 and was ordered to stop selling the personal information of Californians entirely. S&P Global paid $62,600 over a registration lapse that was attributed to an administrative error. Enforcement so far has focused on registration, but with deletion processing now under way, attention is expected to turn to brokers that mishandle DROP requests.

There is no private right of action under the Delete Act, so individual residents cannot sue a broker themselves for ignoring a request. Enforcement belongs to CalPrivacy, which investigates and fines.

What changes next

The system is about to get stricter. With the passage of a law known as AB 883, data brokers will be required to process deletion requests at least once every 30 days, effective from 1 January 2027. That tightens the current 45-day cycle and means requests should be handled faster.

The same date brings another change for California residents. From 1 January 2027, California’s right to delete will also cover personal information that a business obtained from third parties, not just information it collected directly. That widens the net, because so much broker data comes from other sources rather than from the person themselves.

Further ahead, from 1 January 2028, data brokers will have to undergo an audit by an independent third party every three years to check whether they comply with the Delete Act’s deletion requirements, and give the audit report to CalPrivacy within five business days of a written request.

California is not the only state with a data broker registry — Oregon, Texas and Vermont also require brokers to register — but it is the only one so far that offers a central deletion tool like DROP. Residents of other states have to contact brokers one by one.

How Californians can use DROP

For California residents who have not yet used the service, the process is straightforward and free. The steps, as described by CalPrivacy and by the security company Malwarebytes, are:

1. Go to the DROP portal at privacy.ca.gov and click “Get Started”.
2. Accept the terms and conditions shown on the platform.
3. Verify that you are a California resident. You can enter your personal information manually, or authenticate through Login.gov, the US government’s login service. If verification fails, you can ask for a review of your eligibility.
4. Create a deletion request by providing an email address or mobile phone number, plus the basic details brokers are likely to hold, such as your name and address, so they can match your records.
5. Submit the request and keep the DROP ID you receive. You can use it to track the status of your request online.

Residents can update their profiles when their identifying details change, for example after moving house or changing a phone number, which helps brokers find additional records. If a broker reports a request as exempt or says no record was found, that does not necessarily mean the broker holds nothing at all — it means nothing matched under the rules that apply to that request.

People who live outside California cannot use DROP, but they can still reduce what brokers hold about them by searching for a broker’s opt-out page and submitting a deletion request and an opt-out from sale or sharing directly, providing only enough detail for the broker to match the record. It is slower and more work, which is exactly the problem DROP was built to solve.

Why this deadline matters beyond California

DROP is a test of a simple idea: that a privacy right is only useful if people can actually use it. California already gave residents the right to ask brokers to delete their data, but the right was buried under hundreds of separate forms, emails and web pages. The state decided to build the plumbing itself — one portal, one request, one tracking number — and to put a deadline and a fine behind it.

For the rest of the United States, and for other countries watching, California has now run the experiment at full scale. If the deletion numbers hold up and the fines land where they should, expect other states to ask how to build the same thing. If brokers find ways around it, or the exemptions swallow the rule, that will be just as important to know.

Frequently asked questions

What is DROP?

DROP stands for the Delete Request and Opt-out Platform. It is a free service run by the California Privacy Protection Agency that lets California residents send a single deletion request to every registered data broker in the state, instead of contacting each broker separately.

Who can use DROP?

Only California residents can use DROP. You must verify that you live in California, either by entering your personal information or by authenticating through Login.gov, before you can submit a request.

What happened on 30 October 2026?

It was the first deadline for data brokers to delete the personal information covered by DROP requests submitted before 1 August 2026. Brokers had to start processing requests on 1 August, and the first batch had a 90-day window that ended on 30 October.

How many people have used DROP?

More than 500,000 Californians had submitted requests by 25 August 2026, according to the Electronic Privacy Information Centre. By early October 2026, sign-ups had passed 550,000. CalPrivacy reported on 6 October 2026 that 99 per cent of users had their information deleted by at least one data broker, and 70 per cent by 100 or more brokers.

What can data brokers refuse to delete?

Brokers can keep information that falls under a legal exemption. That commonly includes information consumers gave the broker directly, information that is publicly available, and certain public records. A broker may also report “record not found” if it holds no matching record for that person.

What happens if a data broker ignores my request?

The broker can be fined $200 per day for each unprocessed deletion request, for as long as the information remains undeleted, plus CalPrivacy’s investigation costs. Residents cannot sue the broker themselves under the Delete Act — enforcement is handled by CalPrivacy.

Does DROP delete everything about me on the internet?

No. DROP only covers registered data brokers in California. It does not delete information held by other companies, such as social media platforms or online shops, and it does not cover other privacy rights such as access, correction or portability of your data.

Conclusion

The 30 October deadline was a quiet milestone with a loud message: California’s one-click deletion system is no longer a plan, it is a working service with more than half a million users and a set of fines behind it. The first results are encouraging — nearly every user had at least one broker delete their information — but the real test is still ahead. Brokers must keep deleting new records every 45 days, soon every 30 days, and the state must show it will fine the ones that do not.

This article is for general information and education only. It is not legal or financial advice.

Sources

• https://dig.watch/updates/california-data-broker-deletion-deadline (Digital Watch, 31 October 2026)
• https://privacy.ca.gov/drop-for-data-brokers/ (California Privacy Protection Agency, accessed 1 November 2026)
• https://www.alexproctor.io/briefings/california-drop-550000-sign-ups-is-your-business-a-data-broker (Alex Proctor, 7 October 2026)
• https://www.malwarebytes.com/blog/news/2026/08/californians-can-tell-data-brokers-to-drop-their-information (Malwarebytes, 3 August 2026)