REPUMATIC · Privacy & Reputation Brief · October 2026

California’s New DROP Tool Can Keep Deleting Your Data After You Submit Once

California’s new DROP system can send one deletion request across more than 600 registered data brokers—and the first large-scale processing cycles are happening now.

I’ve spent enough years looking at personal reputation problems to know that the page somebody finds on Google is often only the end of the trail. Behind it can be a much larger collection of addresses, phone numbers, family associations, inferred interests, device identifiers and other information circulating between companies most people have never heard of. Until now, trying to clean up that layer usually meant chasing brokers one at a time. California has just changed that equation in a pretty substantial way.

What changed

California’s Delete Request and Opt-out Platform—DROP—turns hundreds of individual data-broker deletion requests into one state-run request.

600+ registered data brokers can receive a single DROP request.

500K+ Californians had registered by August 25, 2026.

45 days maximum interval between required broker processing cycles.

10s of millions of records had already been reported deleted by brokers by late August.

Right
Now

October 2026 is still the opening phase

Mandatory broker processing began August 1. CalPrivacy says consumer status updates can take up to 90 days to appear and expects all brokers in DROP to have completed their initial download-and-upload cycle by November. So a request that still shows some brokers as Pending in early October is not automatically evidence that something went wrong.

The shortcut in four steps

The consumer side is considerably simpler than the machinery running behind it.

Verify residency

DROP is currently available to California residents. Residency is verified through the California Identity Gateway.

Add identifiers

Name, date of birth and ZIP are sufficient to submit. Email, phone and optional identifiers can improve matching.

Send once

Your request can be directed to all active brokers in DROP, unless you deliberately exclude individual brokers.

Track status

You receive a DROP ID that lets you see how individual brokers handled the request.

Minimum information: California says you can submit using only your name, date of birth and ZIP code. Adding email addresses, phone numbers or optional device/vehicle identifiers can increase the chances that brokers actually match the request to their records.

The feature that makes DROP different

The part worth remembering

The deletion request stays alive.

If a broker does not find you today, your request does not simply disappear. Brokers must preserve enough information to keep honoring the request, re-check for matching data and take action when a future match appears. California requires the processing cycle to repeat at least every 45 days.

That changes DROP from a one-time cleanup into something closer to a standing instruction: if covered broker data about you reappears later, the request is already there.

Old manual approach	DROP approach	Why it matters
Find brokers individually	One request can reach 600+ registered brokers	Removes a major discovery and administrative burden.
Repeat separate deletion forms	One state-run request	You no longer need to maintain hundreds of independent opt-out workflows.
Deletion may be a snapshot in time	Request remains active	Covered brokers must keep checking for future matching information.
Track confirmations yourself	DROP reports broker statuses	You can see whether a broker deleted, exempted, opted out or failed to locate a record.

What information can help brokers find you?

You do not need every identifier below. Think of each additional identifier as another possible key a broker can use to locate the right record.

Identifier	Required?	Why it may help	Practical note
Name + date of birth + ZIP	Core submission data	Creates the basic person-level matching combination.	You can submit a DROP request with these items.
Email address	Optional	Many broker datasets are indexed or joined by email.	Add relevant addresses you actually use or have used where available.
Phone number	Optional	Provides another common person-level match.	Useful when broker data does not align neatly with your name.
Mobile Advertising ID	Optional	Can identify device-linked advertising data not obviously connected to your name.	California specifically includes MAID as an optional matching identifier.
Connected TV ID	Optional	Can connect a DROP request to smart-TV advertising or audience data.	Location and naming differ by television manufacturer.
Vehicle Identification Number	Optional	Can help identify data linked to a specific vehicle.	California uses name + VIN as one of DROP’s matching lists.

More data can improve matching, but don’t turn this into a hunt for every identifier you have ever had. Use information California’s DROP system actually asks for. CalPrivacy specifically says it does not require or recommend downloading a third-party app merely to discover an Apple advertising identifier.

What the status messages actually mean

This is where the first processing cycle becomes useful. A result other than “Deleted” is not necessarily a failure.

Deleted The broker matched you and deleted the non-exempt personal information covered by DROP.

Exempted A match exists, but the broker says the information may legally be retained under an exemption.

Opted Out An exact one-person match could not be made. The associated information is instead blocked from sale or sharing.

Record Not Found The broker either does not have matching information or could not match what you supplied.

Pending The broker has not yet reported completion. In this early rollout, updates can take up to 90 days.

Pay attention to “Record Not Found.” It does not prove the broker has no information about you. California specifically says it may also mean the broker could not locate you using the identifiers in the request. If you can legitimately add another requested identifier, doing so may improve the next match.

What DROP deletes—and what it doesn’t

The biggest mistake would be describing DROP as an “erase me from the internet” button. It is powerful, but its legal scope is narrower.

Information	DROP?	What to know
Covered information a broker obtained from third parties	Yes, generally	Matched non-exempt personal information must be deleted.
Inferences created from covered broker data	Yes, generally	Regulations expressly address inferences based on covered personal information.
Information held by broker service providers or contractors	Covered	Brokers have obligations to direct service providers and contractors to take required action.
Information you gave a business directly	Not through DROP	If you intentionally created an account or gave the company your email directly, that first-party information generally falls outside the DROP deletion requirement.
Publicly available information	Not necessarily	California lists publicly available information among data DROP does not require brokers to delete.
Legally exempt data	No	Certain information or entities are subject to statutory exemptions.
A negative news story or Google result	No	DROP is a data-broker privacy mechanism, not a search-result removal system.

Not every company is a data broker. The Delete Act’s definition centers on businesses that knowingly collect and sell information about consumers with whom they do not have a direct relationship.

Some sectors are excluded. The statute contains exclusions tied to laws including the Fair Credit Reporting Act, Gramm-Leach-Bliley Act, insurance privacy law and certain health-data processing.

DROP is California-only. You must qualify as a California resident to submit through the state’s platform.

Why this belongs in a reputation audit

Privacy cleanup and reputation cleanup are not the same job—but the two increasingly overlap.

Reduce the raw material

Data brokers can maintain contact data, demographic information, interests, household relationships, device identifiers and inferences. Reducing that data can shrink the background information available for aggregation and resale.

Reduce easy personal discovery

When personal information is broadly syndicated, it becomes easier to connect identities, addresses, relatives and other details. DROP attacks that broker layer rather than trying to clean each downstream appearance manually.

But don’t confuse privacy with suppression

If a damaging court story, article, forum thread or other public page ranks for your name, DROP does not remove that content from Google. That remains a separate reputation problem.

Think upstream

The strongest personal-reputation strategy increasingly asks two questions: “What can people find?” and “What data is circulating behind the scenes?” DROP gives Californians a unusually broad tool for the second question.

The practical DROP checklist

For an eligible Californian, this should be a short process—not an afternoon project.

Use the official California portal

DROP is free. Start at the state’s privacy website rather than paying a third party simply to submit the state request.

Free California residents Official state system

Verify California residency

The California Identity Gateway handles eligibility verification. You do not need to create a separate California Identity Gateway account.

Enter enough information to make matching realistic

Name, birth date and ZIP can get the request submitted. Add useful email and phone information where appropriate. Consider the optional device, TV and vehicle identifiers only when relevant and readily available.

Save your DROP ID

Your DROP ID is the key to checking broker-by-broker status later. California specifically warns consumers not to share it publicly.

Expect mixed statuses

You may see Deleted, Exempted, Opted Out, Record Not Found and Pending at the same time because brokers hold different data and process on different schedules.

Revisit “Record Not Found” results

If you have another legitimate identifier that DROP accepts, adding it can improve the probability of matching. Profile updates are subject to the platform’s timing rules.

Don’t restart the request every month

You don’t need to. The request remains active, and brokers must continue checking for new matching information during later processing cycles.

Reputation warning: don’t assume a successful DROP request means a people-search page, old cached search result or other web page will immediately disappear. Broker deletion, website publication and search-engine indexing are separate layers. Audit them separately.

Primary research sources:
California Privacy Protection Agency / CalPrivacy official consumer guidance and Delete Act materials, reviewed October 5, 2026.
DROP Overview How DROP Works Personal Information & Data Brokers Unique Identifiers 500,000-User Milestone CPPA Data Broker Information

Interactive DROP Check

How strong is your deletion request?

This does not predict exactly how many brokers will delete your records. It shows whether you have supplied enough matching information and what your next practical step should be.

Are you a California resident?

Can you provide name, date of birth and ZIP?

Have you included a relevant email address?

Have you included a relevant phone number?

Do you have a useful MAID, TV ID or VIN to add?

If already submitted, what result concerns you most?