California Residents Can Use DROP to Delete Data
California’s DROP lets residents delete personal data from 600+ brokers in one central request; fines apply.
More than 600 data brokers will soon be required to begin processing requests from California residents seeking to have their personal information deleted through the state’s new privacy platform.
Starting Aug. 1, data brokers will have 90 days to process the requests submitted through the state-run Delete Request and Opt-out Platform, or DROP, which launched in January.
Here’s what to know about DROP, including how it works, how it came to be, and how to submit a request.
Brief history of DROP
In 2018, the California Consumer Privacy Act established privacy rights for residents. In 2023, the state Legislature expanded those rights by passing the Delete Act (Senate Bill (SB) 362, Chapter 709, Statutes of 2023).
The law requires the California Privacy Protection Agency to create a way for consumers to request the deletion of all nonexempt personal information related to them from registered data brokers in a single action.
Not all information, however, must be deleted. Some data is exempt under the law, including certain public records and health information. Businesses also may be allowed to keep information they need for legal compliance, fraud prevention, security purposes or ongoing legal matters.
What is a data broker?
“A data broker is a business that gathers and sells consumer information that the consumer didn’t give them directly,” according to the CPPA.
Any business that can be defined as such must register with the CPPA annually.
Personal information collected and sold by data brokers can include Social Security numbers, precise geolocation data, browsing history, email addresses, phone numbers and shopping habits.
By gathering that data and processing it, data brokers can make inferences about consumers, such as political views, health data, family details, and more.
“Data brokers package, trade, and sell information to various organizations, including ones you’ve never heard of before,” the CPPA says.
Buyers include everyone from advertisers and marketers to political campaigns.
Data brokers can collect this information from businesses that consumers interact with directly, such as music streaming services who collect users’ playlists, grocery stores, and video streaming services that collect viewing history.
What does California’s DROP do?
The CPPA says DROP is meant to provide California residents with a way of submitting one request to all registered data brokers in the state, instead of contacting them individually, to delete their personal information.
When a resident submits a request through DROP, the request is made available to registered data brokers. Brokers must then determine whether they have information associated with that consumer and, if so, delete any nonexempt personal information they maintain, subject to limited legal exceptions.
Brokers are required to check the system at least once every 45 days to process any new requests.
“When you submit a DROP request, the business you interact with directly will keep the information they have collected about you. However, data brokers that buy or collect that information must delete it,” the CPPA says.
According to CPPA, some of the benefits of submitting a request through DROP include:
- More control of your data: DROP helps consumers limit the information data brokers collect and sell.
- Reduced spam and scams: When a consumer’s data is no longer being sold, they will receive less unwanted texts, calls, or emails.
- Greater security: A DROP request can help decrease the risk of identity theft, fraud, and AI impersonations
One thing to bear in mind, though, is that if data brokers delete a consumer’s personal information, it can affect certain online experiences, the CPPA says.
“For example, you may receive fewer targeted ads or personalized content,” according to the CPPA.
How to make a request in DROP
To make a request in DROP, you must first verify your eligibility.
“If you are a California resident, you qualify to use DROP,” the CPPA says.
The system will ask you to verify your residency by entering basic personal information and signing at Login.gov.
After verifying your eligibility, you will be prompted to create a profile that includes your data.
“Data brokers will compare your data with their records. If there’s a match, all of the data that the data brokers have about you will be deleted, with a few exceptions,” the CPPA says.
The most basic information you can include in your submission includes:
- Name (including maiden names)
- Date of birth
- ZIP code
- Email address
- Phone number
Optional information you can choose to include in a request are:
- Mobile advertising ID (MAID)
- Connected TV ID
- Vehicle identification number (VIN)
“It’s your choice what information you provide,” the CPPA says. ‘The more information you enter, the more likely your data will be deleted.”
Finally, you will be prompted to review your data before submitting your deletion request.
After submitting your request, you will be directed to a confirmation page with a DROP ID, which you should be sure to save.
“You use it if you want to check the status of your request,” the CPPA says.
What to do after submitting request?
You can check the status of your DROP request starting in August online here.
You will find different DROP statuses including:
- Deleted: Data brokers have deleted data tied to you and can no longer sell it. However, they still may keep some information if it is exempt by law.
- Exempted: This means data brokers may keep the information they have about because it is all exempt by law. “This data can include public records or certain health information, but it may still be protected under other laws,” the CPPA says.
- Opted-out: Data brokers could not find an exact match based on the provided information. “For now, these data brokers still have your data but can no longer sell it,” according to the CPPA.
- Record not found: Data brokers could not find your information based on what you provided.
- Pending: Data brokers have yet to process your request. “Under the law, data brokers may take up to 90 days to report back how they processed your request,” the CPPA says.
What if data brokers do not comply with law?
If data brokers do not comply with the law, they may face hefty fines.
If a data broker fails to register with the state, they can face up to a $ 200-per-day fine on top of unpaid fees and enforcement costs. If they fail to delete consumer personal information, they will face the same fines.
