California’s DROP Deadline Is August 1: What Actually Gets Deleted

On August 1, 2026, data brokers registered in California must start deleting the personal information of any Californian who has filed a request through the state’s Delete Request and Opt-out Platform, known as DROP. One free request reaches more than 600 registered data brokers at once. It is the strongest data deletion tool any American has ever had. It is also narrower than most people realize, and the difference matters.

DROP launched on January 1, 2026, but brokers were not required to act on requests until August. That waiting period ends now. This guide covers how to file a request, what happens after August 1, what each status in your DROP account actually means, and the significant gaps DROP leaves behind.

What Is DROP?

DROP is a free, state-run platform built by the California Privacy Protection Agency, the regulator now known as CalPrivacy. It came out of the Delete Act, a 2023 law that gave the agency authority over data brokers and required it to build a single place where consumers could delete their data everywhere at once.

Before DROP, opting out meant finding each data broker, locating its opt-out form, and submitting a request one company at a time. Hundreds of brokers, hundreds of forms. Some brokers deliberately made their opt-out pages hard to find. DROP replaces all of that with one verified request that goes to every registered broker in the state.

Data brokers are companies that collect and sell personal information about people they have no direct relationship with. They compile names, addresses, phone numbers, email addresses, ages, relatives, property records, and advertising identifiers into profiles, then sell them. Most people have never heard of the companies holding their data.

What Happens on August 1, 2026

Between January and July of 2026, Californians could file DROP requests, but brokers had no obligation to act on them. Requests simply sat in a pending state. That changes on August 1.

From that date, every registered data broker must:

• Access DROP at least once every 45 days to download the list of people requesting deletion.
• Compare that list against their own records to look for matches.
• Delete all non-exempt personal information for anyone they match, not just the specific details you submitted.
• Report the outcome of each request, which the law allows them up to 90 days to do.
• Stop selling or sharing your information going forward.

The penalties are real. Under the Delete Act, a broker that fails to delete a consumer’s information faces fines of $200 per deletion request for each day it fails to comply, and $200 per day for failing to register at all. CalPrivacy has already brought enforcement actions and collected fines from brokers that missed registration deadlines, so this is not a paper threat.

How to File a DROP Request

The process is free and takes a few minutes. You must be a California resident, since DROP is a California law and non-residents cannot use it.

1. Go to the official platform. Start at privacy.ca.gov/drop, the state’s site. Do not pay a third party for access. It costs nothing.
2. Verify your California residency. You will confirm your identity through the California Identity Gateway, the state’s secure verification system.
3. Enter your information. You need your full name and date of birth, plus at least one of the following: a phone number, an email address, or a unique identifier.
4. Add more identifiers if you want a deeper deletion. This is the step most people skip, and it matters. You can add multiple phone numbers and email addresses, past and present, plus mobile advertising IDs from your phone, connected TV IDs, and vehicle identification numbers. Brokers match you against what you give them, so the more you provide, the more they can find and delete.
5. Review and submit. Check what you have entered, then submit. Your confirmation page includes a DROP ID, which you use to check your status later.

By default, your request goes to every registered data broker, including ones that register in the future. You can narrow it if you want a specific broker to keep your data, by unchecking that company on the data broker list inside DROP, though there are few good reasons to do so.

What Your DROP Status Actually Means

After August, your DROP account will show a status for each broker. The wording is easy to misread, and one status in particular does not mean what most people assume.

Status	What it actually means
Pending	The broker has not processed your request yet. It has up to 90 days to report back.
Deleted	Your data was deleted and will no longer be sold. The broker may still keep information that is exempt under the law.
Opted-out	The broker could not make an exact match from what you provided. It still has your data. It just cannot sell it.
Exempted	The broker is allowed to keep everything it has about you, because all of it is exempt by law. This can include public records and certain health information.
Record not found	The broker either has no information about you, or could not locate you from the details you gave.

Pay attention to “opted-out.” It sounds like a win, and it is a partial one, but the broker still holds your profile. It failed to match you. The fix is straightforward: go back into your DROP profile and submit more identifiers, such as an old email address or a previous phone number, so the broker can find you. Updated requests can be filed at any time, and brokers get up to three months to process them.

The same goes for “record not found.” Sometimes it means the broker genuinely has nothing on you. Other times it means you did not give it enough to work with.

What DROP Does Not Cover

DROP is a genuine advance, and every eligible Californian should use it. But it is worth being clear about where it stops, because a lot of people are going to file a request in August and assume they are finished.

It only works for California residents. If you live anywhere else, you cannot use DROP. Roughly half of US states give consumers no data deletion rights at all, so for most Americans, opting out still means going broker by broker.

It only reaches registered data brokers. The requirement applies to companies that have registered with CalPrivacy. Sites that never registered, or that do not meet the state’s legal definition of a data broker, are untouched by your request.

Exempt data stays put. Even a broker that marks your request “deleted” is permitted to keep information that is exempt under the law. Public records and certain health information can fall into this category, and businesses whose activities are already governed by the Fair Credit Reporting Act or HIPAA do not have to register as data brokers in the first place.

First-party data is not covered. A company you actually did business with has a direct relationship with you, so the data it collected from you directly is outside the Delete Act’s reach.

It does nothing about search results. This is the biggest misunderstanding. DROP deletes data from broker databases. It does not remove pages from Google, take down a mugshot site, delete a news article, remove an old court record, clean up a people-search profile that is not on the registry, or touch your social media footprint. If someone searches your name tomorrow, DROP has not changed what they find.

What to Do About the Gaps

File your DROP request first. It is free, it is legally enforceable, and nothing else offers that leverage. Then work the edges.

Check your status and add more data. Come back after August, look for any broker showing “opted-out” or “record not found,” and submit additional identifiers so they can match you. This single step converts partial results into real deletions.

Handle the sites DROP misses one by one. Many of the people-search sites that surface when someone Googles your name require their own opt-out process. We have step-by-step guides for several of the most common, including TruePeopleSearch, Spokeo, and MyLife.

Deal with search results separately. Removing data from a broker does not clear the page from Google. If an old profile page still appears after the source is gone, Google’s tool for refreshing outdated content can speed things along. Our guide on the Remove Outdated Content tool explains how, and our broader guide on removing content from Google search covers what can and cannot be taken down.

Keep going after the one-time cleanup. Brokers re-collect data continuously from public records and other sources. A DROP request stops registered brokers from selling your information going forward, but new profiles can appear on unregistered sites. Periodic monitoring is what keeps a cleanup from unravelling. Our guide to protecting your online privacy covers the longer-term habits.

Frequently Asked Questions

What is California’s DROP and who can use it?

DROP is the Delete Request and Opt-out Platform, a free state-run system from the California Privacy Protection Agency. It lets a California resident submit one request that reaches more than 600 registered data brokers, requiring them to delete personal information and stop selling it. Only California residents are eligible. The platform launched January 1, 2026, and data brokers must begin processing requests on August 1, 2026.

What happens on August 1, 2026?

Registered data brokers must begin processing DROP deletion requests. From that date, they must access the platform at least once every 45 days, compare requests against their records, delete all non-exempt data for anyone they match, and report the outcome within 90 days. Failure to comply carries fines of $200 per deletion request for each day the broker does not delete the information. Requests filed before August will have sat in a pending state until then.

Does DROP remove my information from Google search results?

No. This is the most common misunderstanding. DROP deletes data held in registered data brokers’ databases. It does not remove pages from Google, take down mugshot sites, delete news articles or court records, or clean up people-search profiles that are not registered brokers. If someone searches your name after your DROP request completes, the search results themselves will look the same unless you address them separately.

What does the “opted-out” status mean in DROP?

It means the data broker could not make an exact match based on the information you provided. The broker still has your data. It simply can no longer sell it. This is a partial result, not a deletion. The fix is to log back into your DROP profile and submit more identifiers, such as an old email address, a previous phone number, or a mobile advertising ID, so the broker can locate you in its records and delete the data.

Do I have to pay to use DROP?

No. DROP is free and operated by the State of California at privacy.ca.gov/drop. No company can file a DROP request that is more effective than the one you file yourself, because the obligation comes from state law. Be cautious of any service charging for DROP access specifically. Paid privacy services are useful for the many sites and search results DROP does not cover, which is a different job.