California residents can use new tool to demand brokers delete their personal data

California is giving residents a new tool that will make it easier for them to limit the ability of data brokers to store and sell their personal information.

While state residents had the right to demand that a company stop collecting and selling their data starting in 2020, doing so required an arduous opt-out process with each individual company. The Deletion Act, passed in 2023it was supposed to simplify things by allowing residents to make a single request to have more than 500 registered data brokers delete their information.

Now it Delete requests and opt-out platform (DROP) actually gives residents the ability to make that request. Once DROP users verify that they are California residents, they can submit an erasure request that will go to all current and future data brokers registered in the state.

But this does not necessarily mean that all your data will be deleted immediately. Brokers are supposed to start processing requests in August 2026 and then have 90 days to process actual requests and report. If they do not delete your data, you will have the option to submit additional information that may help them locate your files.

Companies will also be able to retain first-party data they have collected from users. Only brokers seeking to buy or sell this data—which can include your social security number, browsing history, email address, phone number, and more—should delete it.

Some information, such as vehicle registration and voter records, are exempt from deletion because they come from public documents. Other information, such as sensitive medical information, may be covered by other laws such as HIPAA.

The California Privacy Agency says that in addition to giving residents more control over their data, the tool could lead to fewer “spam messages, calls or emails” and also reduce the “risk of identity theft, fraud, AI impersonation, or your data being leaked or compromised.”

The penalty for data brokers who fail to register or delete requested consumer data is $200 per day, plus enforcement costs, according to the agency.