California Delete Act (SB 362) and DROP Platform

What the Delete Act actually does

If you live in California, the Delete Act (Cal. Civ. Code §1798.99.80 et seq.) gives you one button. You push it once. Every data broker registered in the state has to delete what they have on you and stop selling it.

That's the headline. One submission. 500-plus brokers covered. No fee.

Before this law, opting out meant filling out a different form on every broker site. Some had a contact email. Some made you fax. Some made you mail a notarized letter. The Delete Act collapses that into a single state-run portal called DROP — the DELETE Request and Opt-Out Platform. You sign in, verify who you are, and submit. The state handles distribution.

The bill was signed in October 2023. Broker registration started January 1, 2024. The consumer portal went live in January 2026. The compliance deadline for brokers — when they're legally required to start processing requests through DROP — is August 1, 2026.

Who it protects

The Delete Act protects California residents. Full stop.

If you're a sworn officer, deputy, firefighter, paramedic, dispatcher, or correctional officer, and you live in CA, you're covered. The law doesn't single you out by profession. It treats every CA resident the same. That's actually useful — there's no proof of status, no employer letter, no eligibility check beyond proving you are who you say you are.

If you're stationed in California temporarily but your legal residence is elsewhere, the protection is thinner. The portal verifies CA residency. If you maintain a CA driver's license and a CA address, you qualify.

Family members aren't auto-covered the way Daniel's Law covers them in NJ. Each person in the household submits their own DROP request.

How to use it

The mechanics are simple by design.

1. Go to consumer.drop.privacy.ca.gov.
2. Create an account. The portal uses identity verification — driver's license or state ID, plus knowledge-based questions.
3. Enter the personal information you want suppressed. Name, prior names, current address, prior addresses, phone numbers, email addresses tied to you.
4. Submit.

The state forwards your request to every registered broker. Starting August 1, 2026, each broker has to access DROP at least every 45 days and process every verified deletion request within 45 days of seeing it. They also have to keep deleting going forward — once you're on the list, new data they pick up about you has to be deleted too.

That recurring obligation is the part that matters. Most opt-out laws were one-shot. The broker deletes you, then re-lists you six months later from a fresh ingest. DROP makes the deletion ongoing.

Where it has teeth — and where it doesn't

The CA Privacy Protection Agency runs enforcement. They stood up a Data Broker Enforcement Strike Force in November 2025 specifically to chase down unregistered brokers and non-compliant ones. Penalties for failure to register are $200 per day plus the registration fees the broker dodged. By January 2026, more than 155,000 California residents had used DROP to submit deletion requests. The portal is being used.

Where it falls short:

• Registration gaps. A June 2025 Privacy Rights Clearinghouse analysis found significant registration gaps in other state broker registries (Vermont, Oregon). California's enforcement is the strongest in the country, but compliance is still uneven. A broker that fails to register isn't subject to DROP requests.
• High-risk LE brokers. Accurint (LexisNexis), TLOxp (TransUnion), and Pipl primarily serve law enforcement and licensed investigators. Some of these claim exemptions under the Gramm-Leach-Bliley Act or argue they don't fit the broker definition. They may be exempt from DROP, or they may register but slow-walk requests.
• Non-broker exposure. DROP doesn't reach county recorder property records, court filings, your own social media, or sites that publish information directly rather than aggregating it from other brokers.
• August 1, 2026 deadline. Until then, brokers aren't required to process DROP requests, even if you've submitted one. Submission early is fine — the requests queue up — but action on them is gated to that date.

The practical takeaway: submit your DROP request now. It's free, takes about 15 minutes, and it gets you in line for the August 2026 compliance window. Don't treat it as your only step.

How DROP stacks with other CA tools

If you're a sworn officer or other covered first responder in California, the full stack:

• DROP / Delete Act — the broker layer. Covered above.
• Vehicle Code §1808.4 — locks your DMV record. Active and retired peace officers, firefighters, dispatchers, judges, prosecutors, and family members.
• Government Code §6254.21 — bars state and local agencies from posting your home address or phone online without consent.
• Safe at Home — substitute-address program through the Secretary of State.
• AB 1242 and SB 345 — agency-side data-sharing restrictions on out-of-state investigations.

Stack what you qualify for.

What we do

We file DROP requests on your behalf and pair them with individual opt-outs at the brokers DROP doesn't reach — the LE-focused ones that may be exempt, the small aggregators that haven't registered yet, and the international sites outside CA jurisdiction. We re-check every two weeks. When a broker re-lists you, we notice them again.

If you've submitted a DROP request and want belt-and-suspenders coverage on top of it, run a free scan to see what's still live.