California Delete Act (SB 362) and DROP Platform

What the Delete Act actually does

If you live in California, the Delete Act (Cal. Civ. Code §1798.99.80 et seq.) lets you make one deletion request that reaches every data broker registered in the state. Each of them has to delete what they hold on you and stop selling it. You file once, the state distributes the request to more than 500 registered brokers, and there's no fee.

Before this law, opting out meant filling out a separate form on every broker site. Some took a contact email. Some wanted a fax. Some required a notarized letter by mail. The Delete Act replaces all of that with a single state-run portal called DROP, short for the Delete Request and Opt-out Platform. You sign in, verify your identity, and submit. The state handles distribution.

The bill was signed in October 2023. Broker registration started January 1, 2024. The consumer portal went live on January 1, 2026. Brokers must begin processing requests on August 1, 2026.

Who it protects

The Delete Act protects California residents. If you're a sworn officer, deputy, firefighter, paramedic, dispatcher, or correctional officer and you live in California, you're covered. The law doesn't single you out by profession. It treats every California resident the same. There's no proof of status, no employer letter, and no eligibility check beyond verifying that you are who you say you are.

If you're stationed in California temporarily but your legal residence is elsewhere, the protection is thinner. The portal verifies California residency. A California driver's license and a California address qualify you.

Family members aren't covered automatically the way Daniel's Law covers them in New Jersey. Each person in the household submits their own DROP request.

How to use it

1. Go to consumer.drop.privacy.ca.gov.
2. Create an account. The portal verifies your identity with a driver's license or state ID plus knowledge-based questions.
3. Enter the information you want deleted: name, prior names, current and past addresses, phone numbers, and email addresses tied to you.
4. Submit.

The state forwards your request to every registered broker. Starting August 1, 2026, each broker must check DROP at least every 45 days and complete each verified deletion within 90 days of retrieving it. The obligation is ongoing. Once you're on the list, new data a broker later collects about you has to be deleted too.

That recurring obligation is what sets it apart. Most opt-out laws are one-shot. A broker deletes you, then re-lists you months later from a fresh data pull. DROP makes the deletion continue.

What enforcement covers and what it misses

The California Privacy Protection Agency runs enforcement. In November 2025 it launched a Data Broker Enforcement Strike Force to find unregistered and non-compliant brokers. Failing to register carries a $200-per-day penalty plus the registration fees the broker skipped. After August 1, 2026, a broker that ignores a DROP deletion request can be fined $200 per request per day. The platform is in active use: by early 2026, more than 200,000 California residents had registered to submit requests.

Where it falls short:

• Registration gaps. A June 2025 Privacy Rights Clearinghouse analysis found hundreds of brokers missing from state registries, including 291 that hadn't registered in California. A broker that never registers isn't bound by DROP. California's enforcement is the strongest in the country, but compliance is still uneven.
• High-risk brokers that serve law enforcement. Accurint (LexisNexis), TLOxp (TransUnion), and Pipl mainly sell to law enforcement and licensed investigators. Some claim exemptions under the Gramm-Leach-Bliley Act, a federal financial-privacy law, or argue they don't meet the broker definition. They may be exempt from DROP, or they may register and still be slow to act.
• Exposure DROP can't reach. DROP doesn't touch county recorder property records, court filings, your own social media, or sites that publish information directly instead of buying it from other brokers.
• The August 1, 2026 deadline. Until then, brokers aren't required to act on DROP requests, even one you've already filed. Filing early is fine, since requests queue up, but action on them is gated to that date.

So file your DROP request now. It's free and takes a few minutes, and it puts you in line for the August 2026 window. Don't treat it as your only step.

How DROP stacks with other California tools

If you're a sworn officer or another covered first responder in California, these tools stack with DROP:

• DROP and the Delete Act: the broker layer, covered above.
• Vehicle Code §1808.4: locks your DMV record. Covers active and retired peace officers, firefighters, dispatchers, judges, prosecutors, and their family members.
• Government Code §7928.205: bars state and local agencies from posting your home address or phone number online without your consent. This was Government Code §6254.21 until California recodified the Public Records Act in 2023.
• Safe at Home: a substitute-address program run through the Secretary of State.
• AB 1242 and SB 345: limits on how California agencies share data for out-of-state investigations.

You file these four yourself, directly with the DMV, your agency, or the Secretary of State. They aren't broker opt-outs, so they sit outside what we do. We handle the broker layer: DROP plus individual opt-outs. Use every tool you qualify for.

What we do

We file DROP requests for you and pair them with individual opt-outs at the brokers DROP doesn't reach: the law-enforcement-focused ones that may claim an exemption, the smaller aggregators that haven't registered, and the international sites outside California's jurisdiction. We keep checking, and when a broker re-lists you, we file again. If you want continuous coverage on the gaps the state platform leaves open, our monitoring plan backstops DROP.

If you've already filed a DROP request and want coverage on top of it, run a free scan to see what's still live.