California's DROP platform forces data brokers to honor bulk deletion requests

As of August 1, California’s Delete Request Opt-out Platform (DROP) is enforceable, requiring the state’s roughly 600 registered data brokers to honor consumer deletion requests submitted through a single online portal. The system spares residents from having to contact each broker individually to stop the sale of their personal information. Since the portal opened January 1, about 350,000 Californians have already registered. Brokers get 45 days to process each request, and the clock resets for subsequent submissions.

Enforcement carries real teeth. Non-compliant companies face fines of $200 per day for each affected resident, and the California Privacy Protection Agency (Cal Privacy) says it has a dedicated team pursuing violators. The agency has already penalized 12 brokers tens of thousands of dollars apiece simply for failing to register with DROP. Cal Privacy’s Tom Kemp framed personal data as the ‘oil’ of the digital economy—harvested from shopping, streaming, and browsing, then packaged into dossiers sold for targeted advertising and, increasingly, exploited by criminals who source victim data from brokers.

The tool has clear limits worth noting: only California residents can use it, and it won’t scrub every trace of personal information online. Registration doesn’t cover unregistered brokers or data already resold downstream, so the agency still advises users to stay alert for scams and take additional protective steps. Even so, DROP represents one of the most concrete mechanisms yet for consumers to reclaim leverage over the data-broker industry at scale.