California residents can use a new tool to ask brokers to delete their personal data

California is offering residents a new tool that will make it easier for them to limit the ability of data brokers to store and sell their personal information.

While state residents have the right to ask the company to stop collecting and selling their data since 2020, doing so requires an arduous opt-out process with each individual company. The Deletion Act, passed in 2023, was supposed to simplify things, allowing residents to make a single request to more than 500 registered data brokers to delete their information.

Now, the Delete Requests and Opt-Out (DROP) Platform gives residents the ability to make that request. Once DROP users verify that they are California residents, they can submit a deletion request that will go to all current and future data brokers registered with the state.

But this does not necessarily mean that all your data will be deleted immediately. Brokers are supposed to start processing orders in August 2026, and then have 90 days to actually process and report on the orders. If they do not delete your data, you will have the option to submit additional information that may help them locate your records.

Companies will also be able to retain first-party data they have collected from users. It’s only brokers seeking to buy or sell that data — which can include your Social Security number, browsing history, email address, phone number, and more — that will be required to delete it.

Some information, such as vehicle registration and voter records, is exempt from deletion because it comes from public documents. Other information, such as sensitive medical information, may be covered under other laws such as HIPAA.

California’s privacy watchdog says that in addition to giving residents more control over their data, the tool could lead to fewer “unsolicited texts, calls, or emails” and also reduce “the risk of identity theft, fraud, AI impersonation, or your data being leaked or compromised.”

The penalty for data brokers who fail to register or fail to delete required consumer data is $200 per day, plus enforcement costs, according to the agency.