California's DELETE Act and DROP: What It Means for Your Privacy in 2026

On January 1, 2026, California launched something no other state has ever attempted: a single button that tells every registered data broker in the state to delete your personal information.

It's called the Delete Request and Opt-out Platform — DROP — and it's the enforcement mechanism for California's DELETE Act, signed into law in 2023. For California residents, it represents the most powerful consumer privacy tool ever created in the United States.

For everyone else, it's a reminder of how far behind the rest of the country remains.

What DROP Actually Does

DROP is a state-run website where California residents can submit a single, verified deletion request that gets sent to every data broker registered with the California Privacy Protection Agency. As of 2026, that's over 500 companies.

The process is simple: you verify your California residency through the state's identity gateway, provide identifying information (name, address, email, phone number, date of birth), and submit. DROP hashes your information — converting it into a one-way encrypted format — and distributes it to registered data brokers.

Starting August 1, 2026, data brokers are legally required to check DROP at least every 45 days, compare the hashed identifiers against their own records, and delete matching data. They must report the status of each request — deleted, opted out, exempt, or not found — back through the system.

The penalties for non-compliance are steep: $200 per request, per day. CalPrivacy has already signaled aggressive enforcement, launching a "Data Broker Enforcement Strike Force" and issuing fines to non-compliant companies within the first week of 2026.

What DROP Doesn't Do

DROP is a significant step forward, but it has real limitations.

What This Means If You Live in California

Use DROP. It's free, it's government-run, and it covers an enormous number of data brokers in a single action. Submit your request now — the sooner you're in the system, the sooner your data starts being queued for deletion.

But don't stop there. DROP addresses data brokers but leaves several major exposure vectors untouched. After submitting through DROP, you should still manually opt out of people-search sites that may not be registered, audit and harden your social media privacy settings, opt out of Clearview AI and PimEyes separately, and strip EXIF metadata from any photos you post publicly.

Think of DROP as the foundation, not the entire building.

What This Means If You Don't Live in California

You're on your own.

As of February 2026, no other state has a centralized deletion mechanism comparable to DROP. Several states — Colorado, Connecticut, Utah, Virginia, and others — have consumer privacy laws that give you the right to request deletion from individual companies. But you have to submit those requests one company at a time, navigate each company's individual opt-out process, and follow up to confirm compliance.

There are a few practical options. First, you can do it yourself using guides like the one we've published on this blog. Expect to invest 15-20 hours for the initial round, plus quarterly maintenance. Second, you can use an automated removal service. Companies like DeleteMe and Incogni submit opt-out requests to hundreds of data brokers on your behalf. They're effective for breadth but rely on automated scripts that can miss sites requiring manual intervention. Third, you can hire a privacy consultant. Services like Dark Scrub handle the process manually, verify every removal, and cover areas that automated services can't — including facial recognition, social media hardening, and sites that require phone calls or complex multi-step processes.

There's a reasonable argument that California's DROP will pressure other states to adopt similar tools. Several states have privacy legislation in various stages of development. But legislation moves slowly, and there's no guarantee your state will act anytime soon.

The Bigger Trend

DROP is the most visible example of a broader shift: governments are starting to treat data brokers as a regulatory problem, not just a consumer inconvenience.

CalPrivacy fined a data broker $42,000 in the first week of 2026 for selling the personal information of people with Alzheimer's disease and drug addiction. The enforcement posture is aggressive and specific.

Whether this momentum reaches other states — and how quickly — will determine whether data privacy becomes a right Americans actually have or a privilege limited to Californians.

In the meantime, the tools for protecting yourself exist. They're just not centralized, not automated, and not free (in terms of time or money). The question is whether the value of your privacy is worth the investment.