A sweeping new California privacy law is giving residents unprecedented power to erase their personal data from hundreds of data brokers
-
A centralized deletion system took effect January 1 under one of the nations strictest privacy laws
-
Californians can now submit a single request forcing more than 500 brokers to delete and stop collecting their data
-
Privacy advocates say the law could become a model for other states
Californians gained a powerful new tool this month to curb the collection and sale of their personal data, as one of the strictest privacy laws in the country officially took effect.
The law allows residents to submit a single request requiring hundreds of data brokers to delete personal information they have collected and to stop collecting it in the future, significantly lowering the barrier that previously kept most people from exercising their privacy rights.
Data brokers quietly amass vast personal profiles
According to the California Privacy Protection Agency, more than 500 data brokers actively collect personal information from a wide range of sources and package it for sale to marketers, private investigators, and other customers.
The nonprofit Consumer Watchdog has warned that these companies scrape data from automakers, technology firms, restaurants, device manufacturers, and other businesses to build detailed profiles that can include financial information, purchases, family situations, diet and exercise habits, travel patterns, and entertainment preferences.
Earlier law saw limited use due to high burden
Californias Delete Act first took effect two years ago, requiring data brokers to provide residents with access to their data and the ability to request its deletion.
But Consumer Watchdog found that only about 1 percent of Californians used those rights during the laws first year. The main obstacle was scale: residents had to submit separate deletion requests to each broker, an impractical task given the hundreds of companies involved.
New platform centralizes deletion requests
That problem is now addressed by a new law known as DROP short for Delete Request and Opt-out Platform which took effect January 1.
DROP allows California residents to submit a single deletion and opt-out request. The California Privacy Protection Agency then distributes the request to all registered data brokers on the individuals behalf.
Beginning in August, brokers will have 45 days after receiving a request to report whether they found matching records and whether the data has been deleted. If a match is found, brokers must delete all associated data, including inferred information, unless a specific legal exemption applies.
Residents must verify identity and residency
To use the system, individuals must first prove they are California residents. The platform then asks for identifying details such as names, email addresses, vehicle identification numbers, and advertising IDs tied to phones, televisions, and other devices.
While the process can take time largely due to gathering information stored across multiple devices and accounts the privacy agency says the information is used solely to locate and delete existing data held by brokers.
Privacy advocates see national implications
Supporters say the law reflects the growing risks posed by large-scale data collection, particularly as broker databases are frequently hacked or sold.
Although the law applies only to California, privacy advocates say it could influence legislation elsewhere as concerns grow over the scope and security of personal data collected by brokers.
As data breaches and data sales continue to expose sensitive personal information, Californias new system may offer a blueprint for how other states could rein in the largely opaque data-broker industry.
Posted: 2026-01-08 20:12:54

















