About DROP Watch

DROP Watch is an independent, non-government guide to California’s Delete Request and Opt-out Platform. We republish the official data broker registry in a searchable form and explain what DROP does and doesn’t do.

Disclaimer

DROP Watch is independent. It is not affiliated with, endorsed by, or operated by the California Privacy Protection Agency (CalPrivacy/CPPA) or the State of California. Nothing on this site is legal advice. Data may be out of date or contain errors carried over from the source; always confirm on the official sites.

Sources

• Broker data: the California Data Broker Registry CSV published by the CPPA (download). Current file last modified July 29, 2026; the registry page says “Last Updated: July 29, 2026”. Retrieved October 17, 2026. 603 brokers. SHA-256 of the file we used: 1647b40e25221eb17087623639f3cdb5aadeea54af1f05f89a12be4ae6146b10.
• Registration history: the previous registries linked from the same CPPA page (2020-2023, administered by the Department of Justice; 2024; 2025).
• How DROP works: privacy.ca.gov/drop, How DROP works, Personal information and data brokers.
• Paid services: each company’s own public pricing and coverage pages, linked on the compare page.
• Other states: official Vermont, Texas and Oregon registry pages linked on Not covered.

Methodology

• DROP scope. Every business in the current registry is labeled “in DROP scope”, because registered data brokers must process DROP requests starting August 1, 2026 (per the CPPA registry page). We cannot see DROP’s in-app broker list, so this is unverified per broker.
• Possible exemptions. Flagged when a broker answered “Yes” to being regulated (itself or a subsidiary) under FCRA, GLBA, IIPPA, CMIA or HIPAA. It signals that some of its data may be exempt from deletion; it is not a legal determination.
• Data categories. Taken verbatim from the broker’s Yes/No answers. These are the registry’s specific questions, not a complete inventory of what a broker collects.
• Registry years. We match current brokers to earlier registry files by normalized company name (or DBA), or by website domain when that domain is unique. Renamed or merged companies can be missed, so “first registry found” is best-effort.
• People-search check. Brand and domain text search over each registry entry. “Not found” is unverified.
• No invented numbers. Every statistic is computed from the registry file or quoted from a cited page. Where we couldn’t verify something, we say so.

Updates

A script re-downloads the registry, compares it with the previous copy (new, removed and changed brokers), and regenerates every page. If the download fails, the site keeps the last good data. Change history: Registry changes. Raw data used for the site: brokers.json, meta.json.

Corrections

Broker details come from the brokers’ own registrations. To change registry information, brokers must contact the CPPA via the registry page.

— The DROP Watch team