California Delete Act DROP: The Platform Is Live, the Fines Have Started, and Here Is What It Still Misses

The California Delete Act DROP platform stopped being a paperwork exercise on August 1, 2026. That is the date every registered data broker had to start checking DROP (the Delete Request and Opt-Out Platform, the thing most people type into a search box as "DROP California" or "CA DROP") at least once every 45 days and processing whatever was waiting in the queue. By August 25, more than 500,000 Californians had signed up, and the California Privacy Protection Agency (which now brands itself CalPrivacy) had already fined three brokers a combined $205,290, all for failing to register on time rather than for ignoring DROP requests. This is what the Delete Act's enforcement phase looks like as of September 15, 2026, the day the first 45-day processing window closes, and where a single DROP request still leaves you exposed.

What is DROP California, and is there a "California DROP Act"?

DROP is a website, not a law. The law is the Delete Act (SB 362, Chapter 709, Statutes of 2023), which also turns up in searches as the CA Delete Act, and it ordered CalPrivacy to build one place where a California resident can file a single deletion request that goes to every data broker on the state registry. That place is DROP, which opened to consumers on January 1, 2026. So if you are asking what DROP California actually is, the short version is: the state-run deletion portal the Delete Act created, operated by CalPrivacy at privacy.ca.gov. There is no separate "DROP Act". People who search for one are looking for the Delete Act.

Is the privacy.ca.gov DROP website legit, and where do you sign up?

Yes. The official California DROP website is privacy.ca.gov/drop, and the sign-up itself lives at consumer.drop.privacy.ca.gov, both on the state's .ca.gov domain. CalPrivacy says it will never charge you to use DROP. You prove California residency through the California Identity Gateway, either by entering your details directly or by signing in with Login.gov. A site on any other domain that wants a card number to "file your DROP request" is not the CA DROP program, whatever its logo looks like.

How to file a DROP request, step by step

CalPrivacy's how DROP works and help with DROP pages, together with the DROP regulations that took effect January 1, 2026 (Title 11, sections 7600 to 7622 of the California Code of Regulations), lay out the whole consumer flow. In order, with what you will see on screen:

1. Gather the minimum. A name, a date of birth and a ZIP code are all DROP requires to file. Everything else can be added later.
2. Open consumer.drop.privacy.ca.gov and choose Get started with DROP. You are handed to the California Identity Gateway to prove residency, either by entering your details directly or by signing in with Login.gov. CalPrivacy suggests the Login.gov route only if you already hold an account there. No Gateway account is created, and DROP does not keep what you enter at this step.
3. If the Gateway returns "Unable to verify", click the on-screen link to request a review of your eligibility. Section 7622 of the regulations gives you 10 calendar days to explain how you are a California resident and leave an email or phone number. CalPrivacy may ask for documents and replies by email. You qualify if you live in California, or are domiciled here and away for a temporary purpose.
4. Build your profile. You can enter several names (maiden names included), one date of birth, and as many ZIP codes, email addresses, phone numbers, mobile advertising IDs, connected TV IDs and vehicle identification numbers as you have. Every extra identifier is another chance of a match. One wrinkle for iPhone owners, per the unique identifiers page: if Allow Apps to Request to Track is switched off, the phone has no advertising ID to enter.
5. Decide whether any broker should be left out. By default the request goes to every broker active in DROP now and every one that joins later. To spare a particular company, uncheck its box in the Delete data column on the data broker list page and choose Update list.
6. If someone is helping you, whether a removal service, a lawyer or a relative acting as your agent, section 7621 says the agent's full name, email address and trade name must be recorded in your DROP account before you submit. An agent can only step in after your own residency is verified, and cannot cancel the request unless you tell them to.
7. Review and submit. The confirmation page shows an 8-digit DROP ID, and you can have it emailed to you at that moment. Save it. It is the only key to your status page, and CalPrivacy asks you not to share it.
8. Filing for a child or an elderly relative works the same way, with their permission, except that it is their residency the Gateway checks rather than yours.

Two details from the regulations are worth knowing before you type. Section 7613 tells brokers to lowercase everything, strip punctuation and accents (the regulation's own example turns Björn O'Connor-López into bjornoconnorlopez), keep the first five digits of a ZIP and the last ten of a phone number. A hyphen or a +1 in what you enter costs nothing. A nickname does: "Kate" will never match a record filed under "Katherine", so enter both. And a broker that matches one identifier to several people, a shared family email for instance, is not allowed to guess. Section 7613(a)(2)(B) makes it opt every one of them out of sale instead of deleting anyone, which is how a shared inbox turns a would-be Deleted into an Opted-out.

Once filed, you can edit the request or add data, but only once every 45 days (section 7620(d)), and only by going back in through Check DROP status. Brokers are barred from contacting you to verify anything (section 7616(c)), so an email from a "data broker" asking you to confirm your DROP request is not from one.

What the California Delete Act DROP platform requires of brokers

The consumer side is the easy half. The broker side, per CalPrivacy's data broker page and its how DROP works explainer, stacks up like this:

• Pay a $6,000 annual registration fee (plus a third-party processing charge for electronic payment) by the January 31 deadline. A company that starts brokering mid-year pays a prorated first-time access fee instead, from $6,000 in January down to $500 in December under regulation section 7611.
• Set up a DROP account that can actually receive deletion requests.
• From August 1, 2026, check DROP at least every 45 days and pull in the new requests.
• Delete the non-exempt data and report a status for each request back into DROP within that 45-day window. A request the broker can't match to a record still has to be kept on file and treated as an opt-out from sale or sharing, rather than ignored.
• Keep deleting: any newly collected data on a consumer who has filed a request has to go on the same 45-day re-check cycle, which is the part that turns a one-time request into a standing instruction, at least on paper.

A broker doesn't get credit for registering if it then lets requests sit unprocessed, and it doesn't get credit for deleting data if it never reports back. The regulations are explicit that logging in without downloading a list does not count as accessing DROP (section 7601(a)).

Why the August 1 deadline has teeth

The Delete Act attached money to the deadline from the start. The 2023 bill text wrote two administrative fines into Civil Code section 1798.99.82: $200 for each day a broker fails to register, and a separate $200 per deletion request per day for every DROP request a broker fails to delete as section 1798.99.86 requires, running until the broker either fulfils it or shows a valid exemption. Both can be stacked with back registration fees and CalPrivacy's investigative and administrative costs.

A lot of the coverage credits SB 361, which Governor Newsom signed on October 8, 2025 (Chapter 466, Statutes of 2025), with doubling the registration fine from $100 to $200 and inventing the per-request fine. It did neither. Both $200 figures are unchanged from the 2023 act. What SB 361 did to the penalty section was small: it dropped the line that recovered agency expenses had to be "as the court deems appropriate" and made them plain "reasonable expenses". The bulk of the bill is new registry disclosures, including whether a broker sold data to a foreign actor, the federal government, law enforcement or a developer of a generative AI system.

The per-request fine is the one that compounds, and it sat dormant until August 1 because the processing duties it hangs on only began then. A mid-size broker with 50 unprocessed requests that lets a month pass without touching them is looking at 50 × $200 × 30 days = $300,000, before any registration penalty or agency costs. A few dozen ignored requests over a few weeks reaches six figures on their own.

Cybba, LocateSmarter and SalesIntel: the fines so far

CalPrivacy has not waited to make examples. On August 11, 2026 it announced that it had fined Iowa-based LocateSmarter LLC $116,490. The stipulated order, dated August 3, breaks that down: $30,600 for failing to register, $79,890 under the CCPA for demanding the last four digits of a Social Security number and a mailing address before it would honour an opt-out, plus the $6,000 registration fee it had skipped. It was the agency's first case combining CCPA and Delete Act violations. Two days later it fined Cybba, Inc. $52,400 for failing to register by the 2025 deadline. On September 1 it added SalesIntel Research, Inc., a Virginia broker, at $36,400, again for late registration, and said it has now brought "more than a dozen" actions against unregistered brokers. Each order also requires the company to post privacy-request metrics on its website and to process future deletion requests through DROP. All three are registration cases. Nobody has been fined yet for leaving DROP requests unprocessed. The first 45-day access window after August 1 closes today, September 15, and as of this morning the newest item on the CalPrivacy newsroom is still the September 3 advisory, so there is no word yet on how many of the 654 brokers made the deadline or what happens to the ones that did not.

Two days after the SalesIntel decision, the agency published Enforcement Advisory 2026-01, warning that a broker is liable to pay a fine for each day incorrect information appears in the registry, at the same $200-a-day rate as failing to register. That advisory matters for anyone reading the registry, because the registry is self-reported, and we have seen how uneven the self-reporting is (more on that below).

What the CalPrivacy DROP platform has done in its first month of enforcement

CalPrivacy's August 25 release is the first hard data on the platform. It reports 654 brokers in the DROP system (the agency's count of brokers with DROP accounts, not the same thing as the public registry CSV, which had 603 rows when we pulled it on September 14 and gives no way to see which 51 make up the gap), roughly a quarter of them reporting processed deletions in the weeks since the August 1 deadline, tens of millions of records deleted, and a "typical" DROP user whose information has been removed by more than 40 brokers. The agency says 99.9% of participants have had their profile deleted by at least one broker. Those are the agency's numbers, not an independent audit, and the flip side of "a quarter have reported" is that three quarters had not yet. Enforcement is what closes that gap, and the September actions suggest the agency intends to keep at it.

The five DROP request status labels and what each one means

The California DROP system reports one status per broker, and CalPrivacy warns it can take up to 90 days after August 1 before the first one appears. The definitions below are CalPrivacy's own, from the how DROP works page, matched to the response codes brokers must upload under regulation section 7614.

DROP timeline: what has happened and what is still to come

What a broker is allowed to keep, and what a denied request turns into

Section 1798.99.86(c)(2) gives a registered broker two grounds to hold on to your data after a match, and a broker using either one must report Exempted rather than Deleted:

• Keeping the information is reasonably necessary for one of the purposes in CCPA section 1798.105(d): completing a transaction you asked for, security and integrity, debugging, free speech, complying with the California Electronic Communications Privacy Act, consented research, internal uses you would reasonably expect, or a legal obligation.
• The deletion is not required under sections 1798.145 or 1798.146, the CCPA's general exemptions. CalPrivacy's own examples of what lands in Exempted are public records such as vehicle and real-estate ownership and voter rolls, responding to a criminal or civil investigation, patient data under HIPAA, credit data under the Fair Credit Reporting Act and financial data under Gramm-Leach-Bliley.

Three more carve-outs sit outside that subsection. Data you gave a company directly in a first-party interaction stays, and CalPrivacy calls the result a partial deletion (regulation section 7613(b)(1)(A)). Any part of a business covered by the Fair Credit Reporting Act, Gramm-Leach-Bliley or the Insurance Information and Privacy Protection Act is not a "data broker" for that activity at all (section 1798.99.80(c)). And whatever a broker keeps under an exemption may be used only for the exempt purpose. Section 1798.99.86(c)(3) rules out marketing in so many words.

The public-records exemption is the one people-search sites will reach for, and the registry already shows it. Spokeo's entry, which also covers ThatsThem, AnyWho and three other storefronts, states that what it sells is "publicly available information" as the CCPA defines it, and that it registers anyway to tell Californians how to opt out. Its 2024 figures: 8 deletion requests received, 0 complied with in whole, 8 in part, next to 3,795,579 opt-out requests. It also reports that under 5% of its business is GLBA credit-header data. A company that frames its whole product as exempt can be expected to answer a DROP request with Exempted or a partial deletion. Whether that holds is CalPrivacy's call, and nothing on the newsroom addresses it yet.

A request that fails for the other reason, an identifier the broker cannot pin to a single person, is not denied outright. Section 1798.99.86(c)(1)(B) converts it into an opt-out of sale and sharing that the broker must apply within 45 days and pass down to its service providers. That is the Opted-out status in the table. The broker keeps the record and keeps your request on file, so a later, cleaner match still deletes it.

Where the California Delete Act DROP still doesn't reach

DROP is a real tool with a real enforcement record behind it, but it has hard edges.

It only reaches registered brokers. DROP enforces against the companies on California's registry. When we re-downloaded the registry CSV on September 14, 2026, it still had 603 entries, and some of the people-search sites we file removals against most often were not among them. Radaris and National Public Data, for example, have no registry entry at all, so a DROP request never arrives at either. Radaris has since lost its main domain to a New Jersey Daniel's Law judgment, but its records were not ordered deleted and sister sites are still online. An unregistered company is invisible to DROP until CalPrivacy catches up with it, which is what Cybba and SalesIntel were fined for.

One registration can cover many storefronts, and the metrics behind it are self-reported. Mississippi Tornado Alley, LLC registers ten sites on a single entry (FastPeopleSearch, FastBackgroundCheck, USPhoneBook, CyberBackgroundChecks, SearchPeopleFree, PeopleSearchNow and four more), each of which runs its own separate opt-out form. That entry reports zero deletion requests received in 2024 across all ten sites, on the same line where it reports 993,412 opt-out requests granted and 207,021 denied, so the zero is not a company that gets no mail. Whitepages, by contrast, reports 5,879 deletion requests for 2024 with 182 denied. Cybba, fined in August for never registering, now has an entry that reports 933,258 deletion requests complied with in 2024, a figure nobody outside the company can check. A registry is only as informative as the filings in it, which is the problem the September 3 advisory is aimed at.

What to do about a broker that is not on the registry

Search for yourself on the site and use its own opt-out form. That is the only channel that reaches it, and every broker we cover has a walkthrough in our opt-out guides, such as National Public Data, which is back online and still absent from the registry. For a registered broker that shows Deleted in DROP while its site still lists you, the help with DROP contact form has a reason code for exactly that, "Data broker did not delete my data", and CalPrivacy says it answers in about two weeks. File that, and file the site's own form too. A storefront such as USPhoneBook sits under a single registration with nine sister sites, and in our experience a suppression on one of them does not travel to the others.

It is California residents only. Nothing in the Delete Act reaches beyond the state line. If you live in Arizona, Texas or anywhere else, DROP does nothing for you. Connecticut's version is not required to exist until July 2028, and New Jersey's new law has no central deletion portal at all.

It is a request with a follow-up cycle, not a monitoring service. The 45-day re-deletion obligation applies to data a registered broker newly collects about you. It does nothing about a broker that isn't registered, or a storefront that funnels searches to a data holder you never named. In our opt-out guides the reappearance problem is the rule rather than the exception: suppressed listings return when a supplier refreshes its feed.

One more thing is pending rather than law. SB 923, the Expanding Privacy Rights Act, would widen the CCPA right to delete to all non-exempt personal information a business holds about you, including data it bought from someone else. The Legislature approved it and CalPrivacy applauded the vote on August 28. As of September 14, 2026 it is with the Governor, unsigned, so it changes nothing about what DROP does today.

How to delete my data California-style: one DROP request, then direct opt-outs

File a DROP request at consumer.drop.privacy.ca.gov. It is one data broker deletion request that every California registry broker is legally bound to act on, it is free, it now carries fines that are demonstrably being issued, and the 45-day cycle means a registered broker cannot let your request rot in a queue without consequence. Then log back in after a couple of cycles and read the per-broker status.

Then keep going. Any broker that isn't on the registry, and that includes a meaningful slice of the people-search industry, needs a direct opt-out. If you live outside California, none of this applies to you yet and you are back to site-by-site removal. And even for the brokers DROP does reach, the self-reported metrics above are a reason to check the sites yourself rather than trust the status field.

Frequently asked questions

Does a DROP request remove me from Google?

No. Google is not a registered data broker (the September 1 registry has no entry for Google or Alphabet), and DROP only reaches companies on the registry. A search result is a pointer to a page on someone else's site. When a registered broker deletes the page behind the result, the result goes away once Google recrawls it, which is weeks rather than days. When the page belongs to an unregistered site, DROP never touches it, and you are back to that site's own opt-out.

Do I need to re-file my DROP request every year?

No. Section 1798.99.86(d) makes the request standing: after the first deletion, a broker must re-delete anything new it collects about you at least every 45 days and must not sell or share new data about you at all. Regulation section 7613(c) makes a broker that found nothing keep your request on file and check it against new records before selling them. CalPrivacy's own wording is that DROP is ongoing, not a one-time action. The only reasons to go back in are a new name, number, email, device or car, or a Record not found you want to improve, and updates are limited to one every 45 days.

Does DROP cover people-search sites like Spokeo, Whitepages and TruePeopleSearch?

The registered ones, yes. Spokeo, Whitepages, TruePeopleSearch, BeenVerified, Intelius, PeopleFinders, TruthFinder and Instant Checkmate all appear on the September 1 registry, so a DROP request reaches each of them. Radaris and National Public Data do not. Registered is not the same as deleted, though: Spokeo's registry entry, quoted above, frames its data as publicly available, and that is the exemption to expect. Search for yourself on each site after your first status arrives, and if you are still there, file directly with our Spokeo, Whitepages and TruePeopleSearch guides.

Is DROP free, and is there a paid version?

It is free by statute. Section 1798.99.86(b)(5) forbids charging a consumer to file, and CalPrivacy repeats on the front page that it will never charge you. There is no paid tier on the state's site. Any business that charges to "file your DROP request" is acting as an authorized agent, and under regulation section 7621 its name, email and trade name have to be entered in your DROP account before the request goes in.

Can I use DROP if I don't live in California?

No. Regulation section 7620(a) says residency is verified before a request can be submitted, and a consumer who fails verification cannot file. The definition is broader than a mailing address: you count if you are domiciled in California and away for a temporary purpose, and factors CalPrivacy lists include where your primary residence is, which state issued your licence and where you are registered to vote. If you fail the check and believe you qualify, the 10-day review in section 7622 is the route. Everyone else is on site-by-site removal for now.

How long does DROP take to work?

The statute allows a broker up to 45 days between visits to DROP and 45 more to process and report what it downloaded, so the outside case is about 90 days from filing. For requests filed before August 1 that lands on October 30, 2026. For a request filed today, the same arithmetic runs to mid-December. CalPrivacy's August 25 release says the typical user had already been removed by more than 40 brokers within three and a half weeks, so most statuses arrive well inside the limit, but a broker that reports on the last legal day has not broken any rule.

What happens to the information I type into DROP?

It is hashed before any broker sees it. CalPrivacy's example: you enter an email address, your own screen shows a masked version, and a broker receives a fixed-length string it can compare against its own hashed records but cannot reverse. Brokers may use what DROP gives them only to process deletions (regulation section 7616(a)), must protect it with reasonable security, and must destroy it within 30 days of leaving the registry (section 7615). The residency details you give the Identity Gateway are not passed to DROP and are not retained after verification. CalPrivacy states it does not sell any of it.

Delist My Data is being built for the gap that remains after all of that: continuous, nationwide removal and re-checking that keeps working after the first request is filed, covering the brokers the California Delete Act DROP reaches and the ones it doesn't. We're in pre-launch; join the waitlist for founding-member access.

Sources

• CalPrivacy: Data Brokers and the Delete Request and Opt-Out Platform
• CalPrivacy: Delete Request and Opt-out Platform (DROP)
• CalPrivacy: How DROP works
• CalPrivacy: Help with DROP
• CalPrivacy: Unique identifiers (MAID, connected TV ID, VIN)
• CalPrivacy: Personal information and data brokers (exemptions, hashing, partial deletions)
• CalPrivacy: About DROP and the Delete Act
• CalPrivacy: Newsroom
• DROP consumer sign-in (consumer.drop.privacy.ca.gov)
• CPPA: Accessible Deletion Mechanism (DROP) rulemaking page
• CPPA: Final text of the DROP regulations, 11 CCR sections 7600-7622 (effective January 1, 2026)
• CalPrivacy: Half a million Californians have signed up for DROP (August 25, 2026)
• SB 362, the Delete Act (Chapter 709, Statutes of 2023), bill text
• SB 361 (Chapter 466, Statutes of 2025), California Legislative Information
• Civil Code section 1798.99.86 (accessible deletion mechanism, broker duties, exemptions, audits)
• Civil Code section 1798.105 (CCPA right to delete and its exceptions)
• CalPrivacy: First action against a data broker under both the CCPA and Delete Act (August 11, 2026)
• CalPrivacy: Order of Decision and Stipulated Order, LocateSmarter LLC (August 3, 2026)
• CalPrivacy: Second data broker enforcement action in less than a week (August 13, 2026)
• CalPrivacy: Enforcement blitz continues with action against Virginia data broker (September 1, 2026)
• CalPrivacy: Enforcement Advisory 2026-01 on incorrect registration information (September 3, 2026)
• CalPrivacy: Legislature advances SB 923 to strengthen deletion rights (August 28, 2026)
• California Data Broker Registry (CSV download)