Deleting Data Just Got Easier for Californians, but It’s Just One Piece of the Larger Cybersecurity Puzzle
The newly launched DROP portal could be a game-changer for Californians’ privacy, even though it’s not a replacement for a holistic cybersecurity approach.
In 2023, the California legislature passed the California Delete Act, which required the California Privacy Protection Agency, or CPPA, to “establish, by Jan. 1 2026, an accessible deletion mechanism that … allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor.”
That deletion mechanism became DROP, which went live at the beginning of the year. In addition to giving California residents an easy way to file deletion requests, DROP also requires data brokers to register annually with the CPPA, pay an annual registration fee and process deletion requests every 45 days, beginning on Aug. 1, 2026. The status of deletion requests must then be sent to the CPPA. Fines are set at $200 a day for failing to register by Jan. 31 of each year and $200 a day per consumer, plus enforcement costs, for failure to comply with the deletion request. Additionally, data brokers must undergo a third-party audit every three years, beginning on Jan. 1, 2028.
To benefit from the service, California residents need to access the DROP portal, verify their residency, create a profile and submit requests. According to the California Code of Regulations, a resident is any individual who “is in the State for other than a temporary or transitory purpose, and … every individual who is domiciled in the State who is outside the State for a temporary or transitory purpose.” In other words, if you live in California, you should be able to use DROP (even if you’re outside of the state temporarily), but if you’re just visiting California for the short term, then probably not.
When you create your profile, you can include whatever amount of personal information you’re comfortable with, including your name, address, email address, date of birth, phone number and even things like your mobile advertising ID or vehicle identification number. The CPPA advises that the more information you submit, the better the chances that data brokers will be able to match you to their records, and, therefore, delete your data. Once you’ve entered your information, you can submit your request and track its status using your unique DROP ID. You can update your deletion request at any time with additional or new information.
If a data broker detects a match based on the information you submitted with your request, all of your information held by that data broker will be deleted, except for exempted data such as publicly available data or first-party data you’ve shared directly with the company.
