California’s DROP Platform Launches, Bringing Data Deletion to Thousands of Residents
A groundbreaking new platform is set to go live on August 1st in California, allowing residents to request the deletion of their personal data from over 600 registered data brokers with just a single click. The Delete Request and Opt-out Platform (DROP), managed by the California Privacy Protection Agency (CPPA), marks a significant milestone in the state’s efforts to give consumers greater control over their online information.
Under California’s 2023 Delete Act, data brokers are required to process deletion requests made through DROP, which will become mandatory on August 1st. These data brokers – including advertisers, retail companies, and landlords – collect and sell personal data without consumer knowledge, often for targeted advertising or other purposes. The types of data at stake include Social Security numbers, browsing histories, email addresses, health information, and shopping habits.
More than 300,000 Californians have already registered for the platform since registration opened on January 1st, according to the CPPA. Beginning in August, data brokers will be required to check DROP every 45 days to identify deletion requests, securely match them against their databases, and take action. Companies that haven’t prepared for this regulation may find themselves scrambling to keep up with compliance.
Compliance steps for data brokers include paying an annual fee, setting up a DROP account, conducting retrieval testing, meeting reporting requirements, and maintaining adequate security to prevent unauthorized account access. While Californians seem to have signed up with ease, companies may struggle with Delete Act compliance, depending on their level of preparedness. According to John Pavolotsky, partner at Stoel Rives, “Hopefully things will run relatively smoothly,” but acknowledges that a smooth rollout is probably unrealistic given the scale and complexity of the task.
The massive deluge of opt-out requests could present challenges for organizations, and automation may be the answer. An automated opt-out from the sale and sharing of personal data through the Global Privacy Control – a browser setting that allows users to tell websites they don’t want their information shared or stored – exists but doesn’t apply to deletion.
California’s new law is part of a broader trend in data privacy regulations, with more than 20 US states having passed similar laws requiring parties to delete personal data at the consumer’s request. As a result, companies will soon see whether California views the trial period as an opportunity to work out kinks or if enforcement will be more stringent from the start.
As Californians take advantage of this new platform, it’s essential for consumers to understand how DROP works and what they can do to protect their data. To make the most of this opportunity, we recommend registering for DROP as soon as possible, using a secure connection and strong password to safeguard your account. When submitting deletion requests, ensure that you have all necessary information readily available to avoid delays or complications. By taking these simple steps, Californians can assert their right to control their digital footprint and demand greater transparency from data brokers.
Source: Dark Reading — 2026-07-31