Don’t Let Data Brokers Profit off of Your Personal Data

As of today, data brokers are required to have deleted the personal information of all California consumers who submitted a valid deletion request through the recently introduced DROP (Delete Request and Opt-out Platform) tool before August 1, 2026, the date when data brokers were legally required to begin processing requests.

The Delete Act, passed in 2023, established Californians’ right to submit a single deletion request to all active data brokers operating in the state, and DROP is the tool that allows Californians to exercise this right. As of August 25, 2026, more than 500,000 Californians had submitted a DROP request. Data brokers collect, sell, and process immense volumes of personal information about us, including personally identifiable data like your name; contact information; information about where you live; and information about your personal characteristics like gender, age, marital status, health, income, religion, and political preferences. In addition to diminishing your personal privacy, data brokers also put you at risk of being the victim of a scam or fraud by selling the information to bad actors who could use your data to target you. Data brokers also put people at risk of physical harm by selling individuals’ addresses and location information to people who may use the information to find, stalk, or harm someone; this risk is particularly pronounced for public officials and domestic violence survivors. Data brokers also threaten national security by selling extensive profiles on members of the military and government officials, which can be obtained and used by foreign adversaries to carry out blackmail or phishing schemes to obtain state secrets. California created DROP to give consumers in the state more control over their personal data.

If you live in California, use DROP.

If you are a California resident, you can delete your personal information from every data broker in the state by using DROP via https://consumer.drop.privacy.ca.gov/ and following these 3 steps:

Verify your eligibility

You must be a California resident to use DROP. When you begin the DROP process, you will be directed to verify your residency by providing your name, date of birth, address, and phone number or email address. The state uses the California Identity Gateway to securely verify your residency information, and this tool does not store your personal information after verification.

Create a profile

Next, you must enter your personal information to create a deletion request via DROP. Data brokers will compare the information you input to their records, and if there is a match, they will delete the information, unless an exemption applies to certain data. You can submit as many of the following categories of data as you wish:

• Names (including maiden names)
• Date of birth
• ZIP code
• Email addresses
• Phone numbers
• Mobile Advertising IDs (MAIDs)
• Connected TV IDs
• Vehicle identification numbers (VINs)

Submit your request

Review your submission and submit. You will receive confirmation after you submit, which will contain your 8-digit DROP ID. You can use this ID to check the status of your request.

Californians can also update their submission at any time. For example, if you change your name or get a new phone or car, you can add the updated information to your DROP profile.

Data brokers are required to process the deletion requests that consumers submit through the DROP within 90 days. If the data broker finds records that match the personal information provided by the consumer who submitted the request, it must delete those records. However, some records held by data brokers are exempt from the Delete Act (such as public records information), meaning that data brokers do not have to delete that information in response to a DROP request. Data brokers must also re-check their records at least every 45 days, and if a data broker finds any new information that matches a consumer who previously submitted a DROP request, it must delete that data.

Other states should act now to give their residents these same rights against data brokers.

Readers who are not California residents might be wondering why this one-click deletion right is not available to them. Unfortunately, no federal law requires data brokers to register with a federal entity or gives all Americans the right to control the personal information data brokers collect and sell about them. While a small number of other states—Oregon, Texas, Vermont, New Jersey, and Connecticut—have established data broker registries in recent years, they do not all offer the same protection as California’s DROP. This system also leaves residents of the other 44 states entirely without rights or transparency over what data brokers are doing with their personal data.

Fortunately, momentum to crack down on the data broker industry is growing across the country. Of the six states with data broker registries, two—Connecticut and New Jersey—were enacted just this year. Connecticut’s law requires the creation of a DROP-style deletion mechanism for Connecticut residents, making it the first state to follow California’s lead. New Jersey’s law contains several novel provisions, including significantly higher registration fees than in other states and broader applicability that includes both data brokers and “data collectors.” Also this year, Vermont amended its data broker registry law to require additional disclosures and to direct the state to study the feasibility of implementing a deletion mechanism similar to DROP. Additional states considered bills this year that would have established data broker registries in their states, including New York and Maryland, and lawmakers in those and other states have expressed continued interest in pursuing this type of data broker regulation.

States’ increasing appetite to take on the harms caused by data broker industry is a positive sign. Given Congress’ decadeslong failure to give all Americans’ meaningful privacy rights, EPIC encourages all states to establish data broker registries in their states. Registries shine a light on the shadowy entities trafficking in the sale of personal data, and they are an important prerequisite to giving residents the ability to request that their data be deleted by data brokers. Even more essential, however, is that other states follow in the footsteps of California’s DROP and give their residents the same right over their personal data that Californians have: to request that all registered data brokers delete their personal information.

The ability to control whether companies you’ve never heard of can profit off of your data should not depend on where in the country you live. States have the power to protect their residents from the harms data brokers facilitate, and California has created a model that other states can and should follow. DROP is proof that states can give residents more control over their personal data in a simple, easy-to-use way. Other states should now duplicate California’s success to empower consumers to protect their privacy.