California's DROP deletion platform: since August 1, 2026, data brokers must check for requests at least every 45 days
DROP, California's free Delete Request and Opt-out Platform, has taken deletion requests from California residents since January 1, 2026. Since August 1, 2026, data brokers must download those requests at least once every 45 days, process them within 45 days, and keep deleting a matched consumer's non-exempt personal information at least every 45 days after that. CalPrivacy, the state agency that runs DROP, says "It could take up to 90 days to see your status updated in DROP." It reported more than 550,000 sign-ups as of early October 2026.
- Official page
- privacy.ca.gov/drop
- Requests open to consumers
- January 1, 2026
- Brokers must start processing
- August 1, 2026
- How often brokers must check DROP
- At least once every 45 days
- Time to process a downloaded request
- Within 45 days
- Status updates
- Up to 90 days, per CalPrivacy
- Cost to consumers
- Free
- Who can use it
- California residents
- Fine for failing to delete
- $200 per deletion request per day, plus costs
- Sign-ups reported
- Over 550,000 (early October 2026)
Figures above were read from the Delete Act, CalPrivacy's regulations and CalPrivacy's DROP pages on 2026-10-11. See sources.
Key dates
| Date | What happens | Source |
|---|---|---|
| October 2023 | Governor Newsom approves the Delete Act, SB 362 (Chapter 709, Statutes of 2023), which orders the agency to build a single deletion mechanism by January 1, 2026. | CPPA announcement, October 11, 2023; About DROP page |
| January 1, 2026 | DROP opens to California residents. The DROP regulations and SB 361's new registration disclosures take effect. | privacy.ca.gov; regulations; statute |
| January 1-31, 2026 | Brokers that operated in 2025 register, pay the $6,000 fee and open DROP accounts. | privacy.ca.gov |
| March 2026 | A DROP Sandbox opens for brokers to test their systems. | privacy.ca.gov |
| August 1, 2026 | Brokers must begin downloading and processing requests, at least once every 45 days. | Civil Code 1798.99.86(c); 11 CCR 7612 |
| November 2026 | CalPrivacy expects every broker in DROP to have finished its first download and upload cycle. | privacy.ca.gov/drop |
| January 1, 2027 | SB 923 takes effect, widening the separate CCPA right to delete. | CalPrivacy announcement, September 27, 2026 |
| January 1-31, 2027 | Next registration period. On August 7, 2026, the CalPrivacy Board voted to direct staff to change the registration fee to $9,500. | Board meeting transcript and staff memo |
| January 1, 2028 | Independent third-party compliance audits begin, every three years. | Civil Code 1798.99.86(e) |
| January 1, 2029 | Registrations must say whether the broker has been audited. | Civil Code 1798.99.82(b)(2)(U) |
How a request moves through the 45-day cycle
DROP stores the information you enter in hashed form, and brokers receive it hashed. Brokers pick from six consumer deletion lists, each built on different identifiers: first name, last name, date of birth and ZIP code; email address; phone number; mobile advertising ID; first name, last name and vehicle identification number; and connected TV identifier. The regulations require a broker to select every list whose identifiers match personal information in its records, unless two lists would match exactly the same consumers.
From August 1, 2026, each broker must download its lists at least once every 45 calendar days. It standardizes and hashes its own records the same way and compares them. For each match, it must delete all personal information tied to the matched identifier, including inferences, unless an exemption applies, and direct its service providers and contractors to do the same. If one identifier matches several people, the broker must instead opt all of them out of the sale or sharing of their information. The broker then reports a status for each request within 45 days of downloading it.
The obligation continues after the first pass. A request that matches nothing is kept, and the broker must check newly collected records against it before selling or sharing them. After deleting a consumer's data, a broker must delete that consumer's personal information again at least once every 45 days and may not sell or share new personal information about the consumer, unless the consumer asks otherwise or an exemption applies. If a broker denies a deletion request because it cannot be verified, the law says the broker must process it as an opt-out of sale or sharing. The regulations add: "A data broker shall not contact a consumer to verify their deletion requests submitted through the DROP."
What you submit, and how residency is checked
DROP is for California residents. CalPrivacy's page says you qualify if you live in California, or if you are domiciled in California but outside the state for a temporary or transitory purpose. It names your primary residence, the state that issued your driver's license or ID, and where you are registered to vote as factors.
Residency is checked first, through the California Identity Gateway, a system run by the California Department of Technology. DROP's terms of use say: "Verification is made with assistance from state contracted third-party vendors, including Socure and Login.gov, through the California Identity Gateway." You can enter your information directly or sign in with Login.gov; CalPrivacy suggests the Login.gov option only for people who already have a Login.gov account. CalPrivacy says DROP keeps only whether the gateway verified you, not the information used to verify, which is why some details are entered twice.
For the deletion request itself, CalPrivacy says: "You only need to provide your name, date of birth, and ZIP code to submit a request." You can add other names, including maiden names, email addresses, phone numbers, mobile advertising IDs (MAIDs), connected TV IDs and vehicle identification numbers. "You can add multiples of all data except your date of birth." On iPhones, CalPrivacy notes: "Apple’s iOS operating system does not currently provide the IDFA (their name for a MAID) in its user interface."
If the gateway cannot verify you, DROP shows a link to request a review. Under the regulations, a review request must be made within 10 calendar days of the classification, explain how you are a California resident as defined in California Code of Regulations, title 18, section 17014 (as it read on September 1, 2017), and give an email address or phone number; the agency may ask for documents. A parent may submit a request for a child, or a family member for an elderly relative, with that person's permission and after verifying that person's residency. An authorized agent may help once the consumer's residency has been verified. A request can be amended or canceled no sooner than 45 calendar days after it is submitted.
What DROP deletes and what it does not
| Information | Through DROP |
|---|---|
| Non-exempt personal information a broker holds about you, matched to your identifiers, including inferences | Deleted |
| Information the broker collects about you later | Checked against your request and deleted; may not be sold or shared |
| Records tied to an identifier that several people share | Opted out of sale and sharing, not deleted |
| Information you gave a business directly (first-party data) | Not deleted through DROP; a separate privacy request to that business is the route CalPrivacy describes |
| Information exempt by law, such as public records of vehicle or real estate ownership or voting, data for a criminal or civil investigation, health information governed by HIPAA, credit information under the Fair Credit Reporting Act, and financial information under the Gramm-Leach-Bliley Act | Not deleted (status: Exempted) |
| Publicly available information | Not deleted |
| Brokers you uncheck on DROP's data broker list | Do not receive your request |
| Businesses that are not data brokers | Not covered by DROP |
DROP statuses
| Status | What CalPrivacy says it means |
|---|---|
| Deleted | The broker matched your information and deleted the non-exempt personal information it holds about you. |
| Exempted | The broker has information about you, but the law allows it to keep all of it. |
| Opted-out | The broker could not make an exact match, for example because several people share an identifier. It may still hold the data but can no longer sell or share it. |
| Record not found | The broker has no information about you, or could not match what you provided. |
| Pending | The broker has not processed your request yet. |
Status checks use your DROP ID at consumer.drop.privacy.ca.gov/dropstatus, and a lost ID can be requested by email. CalPrivacy's How DROP works page calls it an 8-digit ID, while its October 6, 2026 FAQ describes "an 8 to 10 character code".
What CalPrivacy has reported so far
| Date | Sign-ups or requests | Brokers | Other figures |
|---|---|---|---|
| January 26, 2026 | More than 176,000 sign-ups | More than 500 (executive director) | |
| June 2, 2026 | More than 300,000 sign-ups | More than 580 in DROP; 581 in the registry | |
| July 10, 2026 | Over 325,000 sign-ups | Over 600 active | |
| August 7, 2026 Board slides (request figures as of July 15) | 345,000+ requests; 1.3 million+ identifiers | 580+ registered; 600+ active in DROP | About one in three requests included a MAID, VIN or connected TV ID |
| August 25, 2026 | More than 500,000 registered | 654 | About 25% of brokers had reported processing requests; 99.9% of consumers had their profile deleted by at least one broker; a typical user by over 40 |
| Early October 2026 (October 6 FAQ) | Over 550,000 sign-ups | Over 650 | 99% of consumers had information deleted by at least one broker; 70% by 100 or more |
Penalties for brokers
The Delete Act sets an administrative fine of $200 for each deletion request for each day a broker fails to delete information as required, plus the agency's reasonable investigation and enforcement expenses. A broker that fails to register owes $200 for each day, the fees that were due and the agency's expenses. From January 1, 2028, and every three years after that, each broker must undergo an independent third-party audit of its compliance and give the report to CalPrivacy within five business days of a written request.
Published enforcement so far has centered on registration. According to CalPrivacy's announcements, Board decisions dated August 10, 2026 ordered LocateSmarter LLC to pay $116,490, for registering late and for requiring partial Social Security numbers before Californians could opt out, and ordered Cybba, Inc. to pay $52,400 for not registering by the 2025 deadline. A decision dated August 27, 2026 ordered SalesIntel Research, Inc. to pay $36,400 for registering late. The Cybba and SalesIntel decisions also require those companies to access DROP and process deletion requests through it. As of October 11, 2026, the Board decisions page lists no decision about a failure to process DROP requests.
A related change: SB 923
DROP operates under the Delete Act. A separate right, the California Consumer Privacy Act's right to ask an individual business to delete your data, changes in 2027. Governor Newsom signed SB 923, the Expanding Privacy Rights Act, on September 27, 2026. According to CalPrivacy, the CCPA right does not currently require a business to delete personal information it obtained from a third party rather than from the consumer; SB 923 closes that gap and requires online-only businesses to offer an online way, such as a webform, to submit privacy requests. CalPrivacy's announcement says: "The law takes effect January 1, 2027."
What we could not confirm
- The exact information the California Identity Gateway asks for. CalPrivacy's pages describe it as basic information, and DROP's terms say users will be prompted for information "such as name, date of birth, and email address". We did not go through the live verification.
- The length of the DROP ID: 8 digits on the How DROP works page, 8 to 10 characters in the October 6, 2026 FAQ.
- Whether the $9,500 registration fee is final. The Board voted on August 7, 2026 to direct staff to amend the fee rule; as of October 11, 2026, CalPrivacy's fee regulation page lists no rule for 2027.
- Proposed changes to the DROP regulations, including audit rules. The Board voted on August 7, 2026 to send draft amendments to formal rulemaking with a 45-day comment period; as of October 11, 2026, CalPrivacy's DROP audits page still describes the work as preliminary.
- How individual brokers are processing requests. CalPrivacy has published only totals and percentages.
- Why CalPrivacy's figure of over 650 brokers in DROP differs from the 603 entries in the public registry file. Businesses that started brokering in 2026 use DROP before their first registration in January 2027, but we found no statement that reconciles the two numbers. The registry is covered in our page on the 2026 registry.
Questions
Is California's DROP free?
Can I use DROP if I do not live in California?
How long does DROP take to delete my data?
Do I have to submit a DROP request again?
How do I check my DROP status?
Sources
- Delete Request and Opt-out Platform (DROP) overview - privacy.ca.gov, read 2026-10-11
- How DROP works - privacy.ca.gov, read 2026-10-11
- Personal information and data brokers - privacy.ca.gov, read 2026-10-11
- Unique identifiers - privacy.ca.gov, read 2026-10-11
- Help with DROP - privacy.ca.gov, read 2026-10-11
- About DROP and the Delete Act - privacy.ca.gov, read 2026-10-11
- DROP terms of use and notice at collection - consumer.drop.privacy.ca.gov, read 2026-10-11
- DROP for data brokers - privacy.ca.gov, read 2026-10-11
- Processing DROP requests - privacy.ca.gov, read 2026-10-11
- Account creation, fees, and annual registration - privacy.ca.gov, read 2026-10-11
- Delete Act, Civil Code sections 1798.99.80-1798.99.89, effective January 1, 2026 - CalPrivacy PDF, read 2026-10-11
- Data broker registration and DROP regulations, 11 CCR sections 7600-7622, effective January 1, 2026 - CalPrivacy PDF, read 2026-10-11
- CPPA Applauds Governor Newsom for Approving the California Delete Act, October 11, 2023 - cppa.ca.gov, read 2026-10-11
- CalPrivacy Celebrates Data Privacy Week with Practical Tools like DROP, January 26, 2026 - privacy.ca.gov, read 2026-10-11
- Privacy Momentum Builds: 300,000+ Californians Sign Up for DROP, June 2, 2026 - privacy.ca.gov, read 2026-10-11
- DROP Data Broker Deletions, How Do They Work?, July 10, 2026 - privacy.ca.gov, read 2026-10-11
- Half a Million Californians Have Signed up for DROP, August 25, 2026 - privacy.ca.gov, read 2026-10-11
- DROP FAQ: 10 Common Questions about DROP, October 6, 2026 - privacy.ca.gov, read 2026-10-11
- Board meeting of August 6-7, 2026: DROP update slides - CalPrivacy PDF, read 2026-10-11
- Board meeting of August 6-7, 2026: staff memo on registration and access fees - CalPrivacy PDF, read 2026-10-11
- Board meeting transcript, August 7, 2026 (fee vote and rulemaking vote) - CalPrivacy PDF, read 2026-10-11
- Data Broker Registration Fee Regulations - cppa.ca.gov, read 2026-10-11
- DROP Audits rulemaking page - cppa.ca.gov, read 2026-10-11
- Board decisions list - privacy.ca.gov, read 2026-10-11
- CalPrivacy Brings First Action Against a Data Broker Under Both the CCPA and Delete Act, August 11, 2026 - privacy.ca.gov, read 2026-10-11
- CalPrivacy Announces Second Data Broker Enforcement Action in Less than a Week, August 13, 2026 - privacy.ca.gov, read 2026-10-11
- CalPrivacy Continues Enforcement Blitz with Action Against Virginia Data Broker, September 1, 2026 - privacy.ca.gov, read 2026-10-11
- California Expands Privacy Protections by Strengthening Deletion Rights (SB 923), September 27, 2026 - privacy.ca.gov, read 2026-10-11
Source links are not affiliate links. This page is general information, not legal advice; how these rules apply depends on the facts and the state.
