DROP eliminates a lengthy process consumers still face elsewhere
-
A new California lawlets residents demand deletion of their personal data from hundreds of data brokers with a single request
-
The system replaces a cumbersome process that required consumers to contact each broker individually
-
Privacy advocates say the change could significantly reduce the mass collection and resale of personal information
Californians have gained a powerful new tool to curb the collection and sale of their personal information, as one of the nations toughest data privacy laws took effect at the start of the year.
The law targets data brokers companies that collect information from a wide range of sources, assemble detailed profiles on individuals, and sell that data to marketers, investigators, and other buyers. According to the California Privacy Protection Agency, more than 500 such companies are currently operating.
A 2024 report from nonprofit Consumer Watchdog found brokers routinely pull data from automakers, tech platforms, restaurants, device manufacturers, and other businesses. The information can include financial details, purchases, family circumstances, travel patterns, eating and exercise habits, entertainment preferences, and more, often affecting millions of people.
Why earlier protections fell short
Californias original Delete Act took effect two years ago, granting residents the right to see what data brokers held about them and to request its deletion.
But the process proved ineffective. Consumer Watchdog found that only about 1% of Californians used those rights in the laws first year. The main reason was the burden placed on consumers: Each deletion request had to be filed separately with every data broker holding their information.
With hundreds of companies involved, the system was too time-consuming and complex for most people to use.
How the new DROP system works
That barrier is now gone. A new law known as DROP short for Delete Request and Opt-out Platform took effect January 1.
DROP allows California residents to submit a single request to delete their personal data and to opt out of future collection. The California Privacy Protection Agency then forwards that request to all registered data brokers on the individuals behalf.
Beginning in August, brokers will have 45 days to report back on the status of each deletion request. If a brokers records match the information provided, all associated data including inferred information must be deleted, unless a narrow legal exemption applies, such as information from direct one-to-one interactions.
To use the system, individuals must first verify that they are California residents.
What consumers can expect
The DROP platform asks users to enter identifying details such as names, email addresses, and device-related information, including vehicle identification numbers and advertising IDs from phones, televisions, and other devices.
Completing the form takes about 15 minutes, much of it spent locating information buried in device settings and online accounts.
While providing more personal information to stop data tracking may seem counterintuitive, privacy officials say the data is used solely to identify and delete records already held by brokers. Advocates argue that the information is already widely circulated in commercial databases, many of which are vulnerable to hacking and resale.
A model for other states?
The new system applies only in California, but privacy experts say it could become a template for broader reforms.
As concerns continue to mount over data hoarding, surveillance marketing, and security breaches involving broker databases, other states may look to Californias approach as a model for giving consumers meaningful control over their personal information.
Posted: 2026-01-06 19:19:02
