Your rights · United States

The California Delete Act, explained

The most consequential data-broker law in the US is switching fully on in 2026. The Delete Act (SB 362) gives Californians something no other jurisdiction has: one deletion request that reaches every registered data broker at once, through a state-run platform called DROP. Here's how it works — and, just as important, where it stops.

How DROP works

1
One request, every registered broker
You create an account on the CPPA’s DROP platform (via cppa.ca.gov), verify you are a California resident, and submit a single deletion request. The state fans it out to every data broker on its registry — several hundred companies.
2
Brokers must act — on a clock
Consumer submissions opened on 1 January 2026. From 1 August 2026, registered brokers are required to process DROP requests, and to keep honouring them on an ongoing basis — deleting new data they acquire about you afterwards, not just what they held on the day.
3
Non-compliance gets expensive
Brokers face penalties of $200 per day, per unprocessed deletion request — on top of existing fines for failing to register at all.
4
It’s free
DROP is a state service. No fee, no subscription.

Where it stops

California residents only. DROP verifies residency; the rights don't travel. A New Yorker — or anyone in the UK — gets nothing from it.
Registered brokers only. The registry is self-reported. Some widely-complained-about people-search sites simply haven't registered, and DROP never touches them.
Data brokers only. Companies with a direct relationship to you — retailers, apps, social platforms — aren't “data brokers” under the Act. For those you still need individual CCPA deletion requests or erasure requests.
No third-party channel. Requests run through your own DROP account — an agent may assist, but there's no bulk or API route. Beware anyone selling “we'll DROP for you” as a product.

If you're not in California

The Delete Act is the exception, not the rule. Everywhere else, removal still means finding each broker holding your data and exercising rights against them one by one — state deletion rights in the US, GDPR erasure in the UK and EU, and per-site opt-outs for the rest. Our opt-out guide library covers the manual routes broker by broker.

Covered beyond the registry

If you're Californian, use DROP — it's free and real. BLACKEYES covers what it can't: unregistered brokers, the rest of the US, and the UK — with every request tracked and re-checked when data reappears. Start with a free look at your exposure.

Run my free exposure check

FAQ

When does the Delete Act take effect?

It is live now. Consumers have been able to submit deletion requests through DROP since 1 January 2026, and registered data brokers are required to process them from 1 August 2026 — with penalties of $200 per day per unprocessed request after that.

Can I use DROP if I don’t live in California?

No. DROP verifies California residency, and the Delete Act’s rights only attach to California residents. Outside California your routes are per-broker opt-outs, your own state’s deletion right if it has one, or GDPR erasure requests in the UK and EU.

What if a broker isn’t registered?

DROP only reaches brokers on the state’s registry. Brokers that fail to register — which includes some of the most complained-about people-search sites — face registration penalties, but until they appear on the registry your DROP request never reaches them. They need direct opt-outs or erasure demands.

How is this different from a CCPA deletion request?

A CCPA request goes to one business at a time and covers any business over the law’s thresholds. DROP is one request fanned out to every registered data broker at once — but only data brokers, and only registered ones. The two are complementary, not interchangeable.

Can a service submit a DROP request for me?

Only in a limited way. The regulations let an authorised agent assist, but requests run through the consumer’s own DROP account — there is no bulk or API channel for third parties. Where services genuinely help is everything DROP doesn’t cover: unregistered brokers, other states, and the UK/EU.