California DROP Deletion Requests Are Underway

California’s Delete Request and Opt-out Platform, or DROP, is now active. DROP allows California residents to submit a single request to delete personal information held by registered data brokers rather than submitting separate requests to each broker.

Data brokers were required to begin accessing DROP and processing requests on August 1, 2026. As of August 28, approximately 500,000 Californians had registered with DROP, 654 data brokers were participating, and approximately 25% of participating brokers reported processing deletion requests.

The California Privacy Protection Agency (CalPrivacy) says 99.9% of consumers had their profiles deleted by at least one data broker, and the typical DROP user had information deleted by more than 40 brokers.

What Data Brokers Need to Do

DROP adds another channel through which data brokers must receive and process consumer deletion requests. California data brokers need procedures to regularly access DROP, retrieve requests, determine whether the request matches information in their records, and take the required action.

The practical challenge is matching each request to the correct consumer information. DROP allows consumers to provide additional identifiers, so brokers should be able to search across relevant datasets using the information provided and apply the request to the appropriate records.

Businesses subject to California’s data broker requirements should confirm that their processes address:

DROP access. The business can retrieve and process requests submitted through the platform.
Identity matching. The business can use the identifiers provided by consumers to locate relevant records across its datasets.
Downstream deletion. Applicable information is deleted from relevant systems and addressed with service providers and other vendors as required.
The business maintains appropriate records of requests and their outcomes.

Businesses that buy, sell, or license personal information should also evaluate whether they qualify as a California data broker and therefore may be subject to DROP requirements.

For companies already subject to California’s data broker requirements, the immediate question is whether their existing deletion procedures account for requests arriving through DROP and whether their systems can reliably locate and remove the information covered by those requests.

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.