California DROP Guide: Delete Personal Data From Data Brokers

Your name, date of birth, phone number, email addresses, search activity, and location history can end up in databases maintained by companies you have never dealt with directly. California’s Delete Request and Opt-Out Platform, or DROP, gives California residents a centralized way to tell active data brokers to delete their personal information instead of hunting down each broker one at a time.

DROP began accepting consumer requests on January 1, 2026. Data brokers were required to begin processing those requests on August 1, 2026. Brokers must access DROP at least once every 45 days, and it can take up to 90 days for a consumer to see a status update. DROP is not an instant “erase me from the internet” button, but it can be a useful ongoing tool for reducing the amount of personal information repeatedly collected and sold by data brokers.

Important: This article provides general U.S. consumer-privacy information, not individualized legal advice. Residency, authority to submit a request for someone else, statutory exemptions, and a particular company’s obligations can depend on the facts. Current instructions from Privacy.ca.gov and the California Privacy Protection Agency, also known as CalPrivacy, control the actual process.

1. What problem DROP is designed to solve

Under California law, a data broker is generally a business that knowingly collects and sells personal information about a consumer with whom it does not have a direct relationship. A broker might combine public records, app activity, purchase and interest data, advertising identifiers, address history, and other sources to build profiles used for marketing, people-search products, risk analysis, or other commercial purposes.

Not every company that has your information is a data broker. Information you give directly to a bank, retailer, carrier, streaming service, or another company while using its products is generally first-party data within that direct relationship. A DROP request does not automatically close those accounts or erase every record the company received directly from you. Publicly available information, information covered by a statutory exemption, and records a company is legally permitted or required to retain may also remain.

The practical expectation is more specific: DROP sends one verified request to active data brokers covered by the system. A broker that can match you should delete non-exempt personal information. If it cannot make an exact match, an opt-out result may still prevent sale or sharing. Closing direct accounts, removing search results, freezing credit reports, and disputing fraudulent accounts are separate jobs.

2. Who is eligible and what to gather first

You must be a California resident to submit a consumer deletion request through DROP. The state explains that residency can include living in California or being domiciled in California while outside the state for a temporary or transitory purpose. Factors can include the location of your primary residence, the state that issued your driver’s license or ID, and where you are registered to vote. If your situation is unclear, review the official residency guidance rather than guessing.

Eligibility verification is handled through the California Identity Gateway. According to the state, you do not need to create a separate California Identity Gateway account, and you may either enter information directly or use an existing Login.gov account. You do not have to open a new Login.gov account just for DROP. Before entering personal information, confirm that the address bar shows privacy.ca.gov, consumer.drop.privacy.ca.gov, or an official California service reached from the state website.

Pre-request checklist

your current legal name and former names;
your date of birth;
your current ZIP code and relevant former ZIP codes;
current and former email addresses;
current and former phone numbers;
your mobile advertising ID, or MAID, if you choose to provide it;
a connected-TV identifier, if you choose to provide it;
a vehicle identification number, or VIN, if you choose to provide it; and
a secure place to store the eight-digit DROP ID issued after submission.

You do not have to provide every item. The state says you can submit a request using basic information you already know, such as your name, date of birth, ZIP code, email address, and phone number. Because brokers compare the values you submit with their own records, a former email or phone number you actually used may improve matching. Do not add another person’s information or invent a number because it seems plausible.

3. Balance data minimization with a useful match

It can feel contradictory to enter personal information into a service designed to remove personal information. The sensible rule is to provide accurate identifiers through the official channel and no more than you are comfortable providing. California says the information entered in DROP is used to complete the request, is not sold or shared for another purpose, and is stored in a protected format. You still choose how much to provide.

A reasonable starting set might be your name, date of birth, current ZIP code, and the email and phone number you have used most consistently. Add a former last name, older email, or prior phone number when it was genuinely connected to significant online activity. MAIDs, connected-TV IDs, and VINs are optional. Do not install an unknown app or sign in to an unfamiliar website just to locate one of those identifiers; use the state’s official instructions and your own device or records.

You can update a DROP profile later. If your name, phone number, email, device, or vehicle changes, you can access the profile through the status process and add new information. Submitting accurate basics now and supplementing the profile when needed is generally more practical than delaying a request for months while trying to collect every possible identifier.

4. How to submit an official DROP request

Start on the official state page. Go directly to the Privacy.ca.gov DROP page instead of clicking an advertisement for a paid removal service.
Verify California eligibility. Read the California Identity Gateway explanation and choose direct verification or an existing Login.gov account, whichever applies.
Enter basic profile information. Carefully type your name, date of birth, ZIP code, email addresses, and phone numbers.
Add relevant former identifiers. Include a former name, email, or number when it is likely to appear in a broker’s records.
Add optional identifiers only when useful. Enter a MAID, connected-TV ID, or VIN only if you can identify it accurately through an official method.
Review the broker list. Active brokers are included by default. You may allow a specific broker to keep your information by removing it from the request, but understand the consequence before doing so.
Check and submit. Make sure you did not mix in a family member’s email, a shared workplace number, or a misspelled address.
Save the eight-digit DROP ID. Treat it as sensitive because it is used to access request status. Do not post it, put it in a group chat, or give it to a removal-service salesperson.

A third party that demands a subscription fee or promises guaranteed, immediate deletion is not the same as the official state service. Consumers should use the California government path and keep the DROP ID private. The state also recommends a current browser, an updated device, and enabled cookies and JavaScript when using the platform.

5. What happens after submission

Each broker compares the identifiers from DROP with its records. When there is a match, the broker is expected to delete all non-exempt information associated with that consumer, not just the email address or phone number used for the match. If no match exists today, the request remains useful: brokers must continue checking for newly matching data at least every 45 days.

Do not expect every result to appear at once. Processing began on August 1, 2026, and a broker can take up to 90 days to report how it handled a request. Different brokers will update on different schedules, so it is normal to see Pending beside completed results for some time. A lack of immediate change in spam or personalized advertising does not by itself prove the request failed.

What each status means

Deleted: The broker matched your information and deleted the non-exempt personal information it held.
Exempted: The broker reports that it has information but may retain all of it under one or more statutory exemptions.
Opted-out: The broker did not make an exact match, but it may no longer sell or share the information covered by the request.
Record not found: The broker did not have information or could not locate you using the information provided. Adding an accurate former identifier may improve matching.
Pending: The broker has not completed or reported its processing yet.

“Record not found” is not always a definitive statement that the company has never had your information. The match may be missing a former email, a previous ZIP code, or a name variant. On the other hand, adding every identifier you can imagine is not the answer. Supplement the profile only with accurate values that were genuinely associated with you.

6. Check status without creating a new security problem

Illustration of one DROP privacy request reaching multiple data brokers — A single DROP request can reach active data brokers for deletion or opt-out processing, with repeated checks for newly matching information.

Use the official DROP status page and the eight-digit ID to review results. Do not save the ID in a browser on a public computer. A trusted password manager or locked note is a better home for it. If you choose to receive the ID by email, check the sender and destination domain, and get into the habit of opening Privacy.ca.gov directly instead of trusting an unexpected email link.

What to record in a simple tracking log

the date you submitted the request;
where the DROP ID is stored;
the first status-check date and a reasonable next review date;
the number of Deleted, Exempted, Opted-out, Record not found, and Pending results;
the type of former email, phone number, or ZIP code later added; and
the date you updated a changed name or contact method.

You do not need to keep full-screen screenshots containing personal details in an ordinary photo library. A dated summary is usually enough, while the DROP ID stays protected separately. If family members are helping, decide who owns the record instead of passing the ID through a group text.

7. What DROP does not delete

DROP focuses on non-exempt information held by data brokers. A retail account you opened, a bank’s customer record, a carrier account, a social-media profile, and a newsletter subscription may require the company’s own privacy or deletion process. If a public-record page still appears in search, you may also need to address the original source and then use the search engine’s removal policies.

Close direct accounts: Use the service’s account settings or customer-support process.
Reduce personalized advertising: Review browser, phone, app, smart-TV, and streaming-device privacy settings.
Prevent new-account credit fraud: Place separate freezes with all three nationwide credit reporting companies when appropriate.
Recover from actual identity theft: Create a plan at IdentityTheft.gov and dispute fraudulent accounts.
Protect a phone number: Set a carrier account PIN and enable a port or transfer lock when available.
Secure exposed accounts: Use unique passwords and phishing-resistant multifactor authentication.

If a phone number is widely used for account recovery, Smartor’s SIM-swap and port-out protection guide can help you review carrier safeguards. If a child’s information may be exposed, use the separate child credit-freeze checklist to protect credit files.

8. Submitting a request for a family member

California explains that a request may sometimes be submitted for another California resident, such as when a parent acts for a child or a relative helps an elderly family member. That does not mean family relationship alone permits you to enter another adult’s information without authority or consent. The correct verification and representation process depends on whether the request involves a minor, legal guardianship, delegated authority, or another recognized relationship.

For a child, keep the child’s identifiers separate from the parent’s. Determine which email addresses or phone numbers were actually associated with the child, and follow the official help instructions for representation. When helping an older relative, discuss what the request does, who will keep the DROP ID, and who will review status. Avoid asking the person to send an ID image or password through ordinary text messaging.

9. Five realistic examples

Example A — a resident with one long-term email: The person enters a current name, date of birth, ZIP code, phone number, and an email address used for more than a decade. Only one or two older addresses that were genuinely used for purchases or accounts are added. The DROP ID goes into a password manager, and status is reviewed with the official processing window in mind.

Example B — a name and address changed after marriage: The resident includes the current name and former last name, the ZIP code before the move, and the email used at that time. If many brokers report Record not found, the person checks spelling and adds only accurate identifiers likely to connect to older records.

Example C — a resident receives heavy spam: The DROP request is submitted without assuming spam will disappear overnight. The resident also reviews carrier PINs, spam filters, app permissions, and advertising-ID settings. Suspicious texts are blocked without opening links or automatically replying “STOP” to an unknown scammer.

Example D — one broker is intentionally excluded: Before unchecking a broker, the resident reviews why that company may need to keep data and understands that the excluded broker will not receive the DROP request. Familiarity with a company name alone is not treated as a reason to exclude it.

Example E — a parent submits for a child: The parent does not flood the child’s profile with every family email. Only identifiers actually connected to the child are used, and the representation procedure is followed. Credit-file protection is handled separately with a minor credit freeze.

10. Common mistakes

Starting with a paid search advertisement: Type or bookmark the official Privacy.ca.gov DROP address.
Assuming DROP closes every direct account: First-party account information may require a separate request to the company.
Expecting an immediate result: Broker processing and status reporting can take time.
Guessing former information: Provide only identifiers you know you actually used.
Chasing optional IDs as if they were mandatory: MAIDs, TV IDs, and VINs are optional.
Saving the DROP ID in a group chat: Treat it as a sensitive status credential.
Confusing Record not found with deletion: It can also mean the broker could not match the profile.
Assuming Exempted automatically proves a violation: A statutory exception may apply; review the official explanation first.
Never updating changed information: Review the profile after a new name, email, phone, device, or car.
Dropping other security controls: Passwords, MFA, credit freezes, carrier PINs, and app permissions still matter.

11. Pair DROP with a 30-minute privacy reset

Five minutes: Verify recovery email addresses and phone numbers on your primary email account.
Five minutes: Replace reused passwords on important accounts and store unique passwords in a manager.
Five minutes: Prefer passkeys, security keys, or an authenticator app over SMS when the account supports them.
Five minutes: Review phone permissions for location, contacts, photos, microphone, and background activity.
Five minutes: Adjust third-party tracking, personalized-ad, and cookie settings in your browser and devices.
Five minutes: Record the DROP submission date and a future status-review date in a secure note or calendar.

When researching privacy steps, do not rely only on a short search snippet or an AI summary. Verify the original page and domain. Smartor’s AI answer verification and privacy checklist provides a repeatable process for checking claims without oversharing personal data.

12. One-page completion checklist

I started on the official Privacy.ca.gov DROP page.
I completed the California residency-verification step.
I entered my current name, date of birth, and ZIP code accurately.
I added only email addresses and phone numbers I actually used.
I provided optional identifiers only when I could verify them through an official method.
I understood the broker list before submitting.
I stored the eight-digit DROP ID securely.
I scheduled a status review that accounts for the processing window.
I understand the difference between Deleted and Record not found.
I will review the profile after a name or contact change.
I will separately clean up direct company accounts and privacy settings.
I will keep passwords, MFA, credit freezes, and carrier protections in place.

FAQ

Is DROP free for consumers?

A California resident does not need a paid removal subscription to submit a request through the official consumer DROP path. Distinguish the state service from commercial websites that request billing information.

Can someone outside California use DROP?

Consumer eligibility is limited to California residents. A Californian temporarily outside the state may still qualify under the official residency standard. Residents of other states should review their state privacy rights and individual broker opt-out procedures.

Does one request include every data broker?

California says current and future active brokers are included by default, unless the consumer removes a broker from the request. That does not mean every company in the country, an inactive business, a company outside the statute, or all first-party account data is included.

Why is my request still Pending?

Brokers process on different schedules and may take up to 90 days to report status. Because processing obligations began in August 2026, mixed statuses are expected during the early cycle. Use the official DROP help path if the published timeline has passed.

Does Record not found mean the broker has no data about me?

Possibly, but it can also mean the broker could not match the profile using the identifiers provided. Check spelling and add only accurate former details that are reasonably likely to match.

Will spam and personalized ads stop immediately?

They may decline, but results and timing vary. Information may already exist in several sources, and companies you use directly may still have first-party data. Continue managing spam filters, app permissions, advertising settings, and direct account opt-outs.

Does DROP remove or freeze a credit report?

No. Credit reporting, security freezes, and fraudulent-account disputes use separate laws and processes. If identity theft is a concern, use the official procedures of the three credit reporting companies and IdentityTheft.gov.

What should I do if I lose the DROP ID?

Use the official DROP help and status-recovery process rather than giving information to an unofficial recovery company. If you elected to receive the ID by email, search that inbox and verify the domain before following a link.

Can I update the request later?

Yes. California says you can access the profile through the status process and add a new name, email address, phone number, device identifier, or VIN. Add accurate changes and consider whether older information remains relevant.

Can I exclude a particular broker?

Yes. Within the broker-list page, you can uncheck the deletion selection for a broker and update the list. The excluded broker will not receive the DROP request, so make the choice only after understanding the effect.

Official sources consulted

By the Smartor Editorial Team. This guide does not endorse a paid data-removal company or privacy product. The law and interface can change, so verify current instructions on the official website before submitting.