California's DROP Is Live: Do You Still Need a Data Removal Service?

The first time I searched my own name

I'd just started building a privacy company, so I assumed I knew what was out there. I didn't.

Old addresses I'd forgotten. A phone number I hadn't used in a decade. And under a heading that said "relatives," my family — listed by name, like someone had built a family tree of my life without ever asking me. None of it was hacked. It was legal, public, and assembled by companies called data brokers.

So when California did something genuinely historic this year, I had a complicated reaction.

What California actually built

Under the Delete Act (SB 362), California launched DROP — the Delete Request and Opt-Out Platform. Instead of hunting down hundreds of data brokers one at a time, a California resident submits one verified request, and every *registered* broker is legally required to delete their information and stop selling it. Roughly 250,000 people have already registered, and the state is pushing toward a million.

It's the most consumer-friendly privacy infrastructure any U.S. state has ever shipped. If you live in California, use it — it's free, and it's the single highest-leverage privacy action available to you.

But three gaps separate "DROP exists" from "you're actually gone."

Gap 1: It's California-only

DROP is a right that comes with California residency. The data brokers selling your information aren't bound by state lines — your legal leverage is. Live anywhere else, and DROP does nothing for you.

Gap 2: Enforcement doesn't start until August 1, 2026

Residents could begin registering on January 1, but brokers don't have to honor a single request until August 1, 2026. After that they must check DROP every 45 days or face fines of $200 per ignored request, per day. Real teeth — but a request filed in June can legally sit unhonored for two months. If your exposure is urgent, "wait until August" isn't an answer.

Gap 3: DROP deletes you from brokers — it doesn't make you disappear

This is the subtle one. DROP forces *registered* brokers to delete you. It does not re-check and re-remove you when a broker re-lists you weeks later — which they routinely do — and it doesn't touch the sources DROP can't reach. A broker can fully comply, and your name and home address can still surface in a search the following month.

DROP is a deletion *event*. Staying gone is a *state* — and nobody holds that state for you.

So do you still need a removal service?

Here's a simple test:

• You live in California, your situation isn't urgent, and you'll re-file periodically → DROP alone may be enough. Use it.
• You live anywhere else, want it gone now, or want it to stay gone → you need continuous removal on top of (or instead of) DROP.

Regulation is finally catching up to data brokers, and it's still slow, regional, and one snapshot at a time. The FTC needed four years to settle with a single broker. California's tool helps one state, starting in August. Meanwhile your data re-lists in days.

None of that answers the one question that actually matters: what's out there about *you*, right now. DROP can't tell you. A search can — and the full version of that search, across the broker network, is the same scan we run at ghostmydata.com. Not a pitch — just the way to finally see your own map before you decide what to do about it.

DROP is a real first step. Just don't mistake the first step for the destination.