California DROP Tool: Opt Out of 614 Data Brokers in 2026

For years, deleting yourself from data brokers meant filing hundreds of opt-out forms by hand. California turned that into a single request.

TL;DR: California’s DROP tool, short for Delete Request and Opt-out Platform, lets any state resident send one deletion request to all 614 registered data brokers at once. It is free, run by the California Privacy Protection Agency, and you file it in a few minutes after verifying your residency. Starting August 1, 2026, brokers must honor these requests on a 45-day cycle. It is the strongest privacy lever California has handed consumers, but it does not cover Google, Meta, or brokers outside the state registry, so treat it as one layer, not a finish line.

Data brokers make money by collecting your name, address, phone number, browsing history, and location, then packaging that profile for sale. Until now, opting out meant hunting down each broker and filing a separate request, hundreds of times over. Most people gave up after the first ten. California changed the math. Its new DROP tool sends one request to every broker registered in the state, and the enforcement deadline that gives it real teeth is almost here. Here is what DROP does, how to file a request, and where its limits are.

What is California’s DROP tool?

Direct answer: DROP is a free California Privacy Protection Agency service that sends a single deletion request to every data broker registered in the state, currently 614 of them.

DROP came out of the California Delete Act (SB 362), a 2023 law that ordered the state to build one place where residents could opt out of every registered data broker at once. The platform went live on January 1, 2026 and is operated by the California Privacy Protection Agency, the same regulator that enforces the state’s privacy laws.

The idea is simple. Every company that qualifies as a data broker has to register with California. DROP takes your one request and routes it to all of them. According to the EFF’s breakdown of the tool, a single DROP request currently reaches 614 brokers. That number climbs as more brokers register, so the count you see when you file may be higher.

How does the DROP tool work?

Direct answer: You verify you are a California resident, enter your identifying details once, and submit. DROP relays that request to every registered broker, who must then delete your data and stop selling it.

The workflow behind DROP is a fan-out. You file once. The platform distributes that request to all registered brokers, so you are not clicking through 614 separate opt-out pages. You give DROP a set of identifiers so brokers can match records to you, and you receive a DROP ID to track the request.

The identifiers you can provide include your name, date of birth, email address, and optional extras like phone number, ZIP code, mobile advertising IDs, connected-TV IDs, and vehicle identification numbers. The more accurate identifiers you supply, the more records brokers can find and delete. You submit information only about yourself. DROP is not built for filing on behalf of other people unless you are an authorized representative under the state’s rules.

Who can use DROP, and what does it actually delete?

Direct answer: Any verified California resident can use DROP. It deletes the personal data brokers hold, like contact details, location, and browsing history, but it does not touch public records such as property or vehicle ownership.

DROP is for California residents only. The platform confirms residency through Login.gov or Socure before it accepts your request. If those automated checks cannot verify you, you can ask for a manual residency review.

Here is the split between what a DROP request clears and what stays out of reach:

That last row on the left is the part people underestimate. Brokers do not only store facts about you. They build inferences, guesses about your health conditions, political leanings, income, or whether you might be pregnant, and they sell those guesses. A DROP request targets that inferred profile too.

How do you submit a DROP request?

Direct answer: Go to the CPPA’s DROP site, accept the terms, verify your residency, enter your details, and submit. You receive a DROP ID to track the request.

Filing takes a few minutes. Here is the flow:

1. Open the official DROP request site run by the California Privacy Protection Agency.
2. Read and accept the Terms of Use.
3. Verify your California residency through Login.gov or Socure.
4. Enter your identifying details. Start with the required fields, then add optional identifiers like phone, ZIP, and advertising IDs to widen the match.
5. Submit, and save the DROP ID you receive so you can check the status later.

One caution. The only place to file is consumer.drop.privacy.ca.gov. Scammers love a new government program, so ignore any email, text, or third-party site that offers to “file DROP for you” for a fee. The real tool is free and lives on a .ca.gov domain.

Why does August 1, 2026 matter?

Direct answer: August 1, 2026 is when brokers must start honoring DROP requests. From that date they have to process deletions at least once every 45 days, so filing early means you are queued the moment enforcement begins.

The tool has been live since January, but the compliance clock starts August 1, 2026. After that date, once a broker receives your request through DROP, they have 45 days to act on it. Brokers also have to keep checking DROP on that recurring 45-day cycle, so a request you file today keeps working against brokers that register later.

Filing before the deadline costs you nothing and puts you at the front of the line. There is no benefit to waiting.

Is DROP a permanent fix for your privacy?

Direct answer: No. Brokers keep collecting new data, new brokers register over time, and companies like Google are not on the registry. DROP is a recurring maintenance task, not a one-time cleanup.

This is where honesty matters more than hype. DROP does a lot for what it covers, but it has clear edges.

Brokers keep collecting. A deletion clears what they hold today. It does not stop them from rebuilding a profile from tomorrow’s data. New brokers register with the state over time, which is why the covered count keeps rising past 614. And plenty of companies that hold huge amounts of your data, Google and Meta among them, are not on the broker registry at all, so DROP never reaches them.

The way your data ends up with these brokers in the first place is often buried in consent screens you clicked through years ago. If you want to see how that pipeline works, read our breakdown of how consent laundering moves your data from an app to a broker. The takeaway is that opting out is not a one-time chore. Plan to refile every several months and pair DROP with the rest of your privacy hygiene.

What should you do if you don’t live in California?

Direct answer: DROP is California-only for now. If you live elsewhere, use manual broker opt-outs, a removal service, and tools like Google’s Results About You. Similar Delete Act bills are moving in other states.

If you are outside California, you do not have a one-click button yet, but you are not out of options. Versions of the Delete Act have been introduced in other states, so this model is spreading. In the meantime, the manual path still works, and we walk through the full process, including the free DIY route and how the paid services compare, in our guide on how to remove your personal information from the internet.

Whether or not you are in California, the single highest-value privacy move remains a credit freeze, because a frozen file blocks the new-account fraud that stolen broker data feeds. We cover that step by step in our guide to credit freezes and identity protection.

Data brokers built a business on the fact that opting out was too tedious to bother with. California removed that excuse. If you live in the state, file your DROP request, save the ID, and set a reminder to do it again next year. Privacy is not a one-time click. It is a habit.