California's DROP Deadline Has Passed: Brokers Must Now Delete Your Data or Pay

On August 1, 2026, California's Delete Request and Opt-Out Platform — DROP — crossed the line from "available" to mandatory. Registered data brokers now have to check the state's platform at least every 45 days and honor deletion requests, or face fines of $200 per request, per day of delay.

For anyone tired of finding their home address for sale online, that's a real step forward. A California resident files one verified request, and every broker registered with the state is legally required to delete their information and stop selling it — instead of chasing hundreds of opt-out forms one at a time.

What actually changed on August 1

DROP went live for residents on January 1, 2026. What flipped this month is the broker obligation: from August 1, processing those requests is no longer optional. The California Privacy Protection Agency now has an enforcement date, a cadence (every 45 days), and a penalty with teeth. You can start at the state's official portal: cppa.ca.gov/data_brokers.

If you're a California resident, using DROP is the single highest-leverage free privacy action available to you right now.

Three things it doesn't solve

• It's California-only. DROP is a right under California's Delete Act (SB 362). If you live in Texas, Georgia, Florida, or the other 46 states, the portal isn't yours to use. A handful of states have their own laws; there is no national DROP.
• It only reaches registered brokers. That's hundreds of companies — but the broader ecosystem runs into the thousands, and many of the people-search sites that publish your address, phone, and relatives aren't the ones filing paperwork in Sacramento.
• It's a one-time request, and your data comes back. Data brokers rebuild their profiles continuously from fresh public records — new property filings, voter rolls, change-of-address data. Remove yourself today, and many brokers re-list you within weeks. DROP is a snapshot; exposure is a stream.

What to do with it

• If you're in California: use DROP. It's enforceable now, and it's free.
• Everywhere else — and for the sites DROP misses: the principle is the same, the work is just harder. Search your own name and city the way a stranger would, note the people-search sites that list you, and file opt-outs. Then re-check, because they'll be back.

The honest version of privacy isn't a request you file once. It's a state you keep — every state, across the sites that make themselves hard to reach, as your data resurfaces. That standing, repetitive removal is exactly the kind of work software should own — which is what we built GhostMyData to do.

Start by looking: a free scan takes about a minute and shows you what's already public about you.