How DROP works
DROP is a free tool run by the California Privacy Protection Agency (CalPrivacy). One request goes to every registered data broker. Everything below is summarized from the official pages at privacy.ca.gov/drop, How DROP works, Personal information and data brokers and the CPPA Data Broker Registry (checked October 17, 2026). If anything here conflicts with those pages, the official pages win.
1. Who can use it
California residents, including people domiciled in California who are temporarily outside the state. Residency is checked through the California Identity Gateway; you don’t need to create an account there. In some cases you can submit for another California resident, such as a parent for a child. DROP is free: the state says it will never charge for it.
2. What you submit
Only your name, date of birth and ZIP code are required. You can add email addresses, phone numbers, mobile advertising IDs (MAIDs), connected-TV IDs and vehicle identification numbers (VINs). The official guidance is that more identifiers make a match more likely. Data is hashed before brokers see it. After you submit you get an 8-digit DROP ID; keep it private and use it to check your status.
3. When brokers act: the 45-day cycle
- Starting August 1, 2026, data brokers must access DROP at least once every 45 days to process deletion requests.
- Brokers have up to 90 days to report how they processed your request; until then your status shows “Pending”.
- After the first pass, brokers must re-check and delete new matching data at least every 45 days. DROP is ongoing, not one-time.
- If a broker doesn’t find a match, it must still keep your request on file — you don’t need to resubmit.
- By November 2026, all brokers in DROP should have completed their initial download and upload cycle.
4. What the statuses mean
| Deleted | The broker matched you and deleted non-exempt personal information it holds about you. |
|---|---|
| Exempted | The broker has information about you but is legally permitted to keep all of it. |
| Opted-out | No exact match; the broker may still hold your data but can no longer sell or share it. |
| Record not found | No information found based on what you provided. Adding identifiers may help. |
| Pending | Not processed yet. |
5. What gets deleted — and what doesn’t
When a broker matches you, it must delete the non-exempt personal information it holds about you, including inferences, not just the identifiers you submitted. It does not have to delete:
- First-party data you gave the business directly (for example, an account you created).
- Exempt data, such as public records and data governed by other laws (HIPAA, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act). See broker pages for which brokers report being regulated under those laws.
- Publicly available data.
You can also exclude specific brokers by unchecking them in DROP’s broker list. More on gaps: What DROP doesn’t cover.
6. Who has to participate
Businesses meeting California’s definition of “data broker” must register with CalPrivacy every year between January 1 and 31. The current registry lists 603 brokers. The official DROP page describes the reach as “over 600 registered data brokers”.
7. Enforcement
Per privacy.ca.gov: failing to register can cost a broker $200 per day plus unpaid fees and enforcement costs; failing to delete consumer personal information can cost $200 per day, per consumer, plus enforcement costs.
This page is a summary for convenience, not legal advice.