On January 1, 2026, California did something no other state has done: it launched a single button that tells every registered data broker in the state to delete your personal information. The tool is called DROP — Delete Request and Opt-out Platform. It is the enforcement arm of the DELETE Act, signed into law in 2023.
For California residents, this is the strongest consumer privacy mechanism in the country. For the other 49 states, it is a reminder of how far behind the rest of the country sits.
What DROP Does
DROP is a state-run portal. You verify California residency, submit your identifying information (name, address, email, phone, date of birth), and the system hashes it into a one-way encrypted format. That hash goes out to every data broker registered with the California Privacy Protection Agency — over 500 companies as of 2026.
Starting August 1, 2026, brokers must check DROP every 45 days, match hashed identifiers against their records, and delete what matches. They report back: deleted, opted out, exempt, or not found. Noncompliance costs $200 per request, per day. CalPrivacy launched a Data Broker Enforcement Strike Force and started issuing fines within the first week of 2026.
Over 500 data brokers registered. Noncompliance penalty: $200 per request, per day.
What DROP Does Not Cover
California residents only. No residency, no access. Alaska, Texas, New York — none of them can use DROP.
Registered brokers only. Companies that dodge registration or dispute their classification are not in the system. Not every broker has complied.
No facial recognition. Clearview AI and PimEyes are not registered under the DELETE Act. Your face stays in those databases regardless.
No social media. Facebook, Instagram, LinkedIn — they have a "direct relationship" with you under the law. DROP does not touch them.
Not instant. Brokers do not have to start processing requests until August 2026, then get 90 days per request. Submit in February, expect deletion by late 2026 at the earliest.
Not permanent. DROP carries forward to new brokers, which is strong. But brokers rebuild profiles from public records — voter rolls, property filings, court documents. If your information is publicly available outside the DROP system, it gets re-collected.
If You Live in California
Use DROP. It is free, government-run, and hits 500+ brokers in a single action. Submit now — the sooner you are in the system, the sooner deletion queues start.
But DROP is the floor, not the ceiling. After submitting, you still need to opt out of people-search sites that are not registered, harden your social media settings, submit separate requests to Clearview AI and PimEyes, and strip EXIF data from photos you post.
If You Do Not Live in California
You are on your own. No other state has a centralized deletion tool. Colorado, Connecticut, Utah, Virginia, and others give you the legal right to request deletion — but you file those requests one company at a time, navigate each company's process, and follow up yourself.
Your options: do it yourself (15–20 hours for the first pass, quarterly maintenance after that), use an automated removal service like DeleteMe or Incogni (good for breadth, weak on sites that need manual intervention), or hire a service like Dark Scrub that handles it manually, verifies every removal, and covers what automated tools miss — facial recognition, social media hardening, sites that require phone calls.
California's move will pressure other states. Legislation is in progress in several. But legislation moves slowly, and no one should wait for their state to act.
The Bigger Picture
Governments are starting to treat data brokers as a regulatory problem, not a consumer inconvenience. CalPrivacy fined a broker $42,000 in the first week of 2026 for selling personal data of people with Alzheimer's and drug addiction. The enforcement posture is aggressive and targeted.
Whether this reaches other states — and how fast — will determine whether data privacy becomes a right Americans actually have or a privilege limited to one state. The tools to protect yourself exist now. They are not centralized, not automated, and not free. The question is whether your privacy is worth the investment.
— J. Daniel, Dark Scrub