California just made it much easier to delete your data across 500 brokers

Alfonso Maruccia

Posts: 2,508   +934
Staff
We want this everywhere: The data brokerage industry quietly trades in some of the most intimate details of people's lives, often without their knowledge or meaningful consent. Now, a new tool could shift that balance – at least giving Californians a faster, centralized way to claw back control over their personal information from hundreds of corporations built to collect, package, and sell it.

Starting January 1, 2026, Californians can submit requests for data brokers to erase their sensitive information through the Delete Request and Opt-out Platform (DROP). The new web-based tool is designed to give residents of the nation's most populous state greater control over their personal data, according to the California Privacy Protection Agency (CPPA).

The DROP initiative is the final phase of a process that began in 2020, when California lawmakers granted residents expanded rights to counter data brokerage abuses. Three years later, the state passed the Delete Act, which streamlined the process for requesting data removal.

Under the 2023 law, users were able to submit a single request asking more than 500 registered data brokers to delete their personal information. The DROP website now builds on that framework by offering a unified, free tool to submit those requests. After verifying eligibility, California residents can create a profile with some basic information – just the minimum data required to identify themselves, if they want.

Once verified, users can send deletion requests to data brokerage companies registered in California. The CPPA has established a clear timeline for the process: the DROP tool launched on January 1, while data brokers are required to begin processing requests on August 1. Sensitive information must be removed within 90 days, the agency said, with new requests evaluated every 45 days.

The Californian privacy agency says that DROP and the Delete Act are going to improve the online experience for residents in significant ways. Data brokers collect massive troves of personal info, ranging from basic details such as Social Security numbers to far more extensive data profiles.

Removing information from these companies could reduce spam and scam attempts and lower the risks associated with identity theft, fraud, AI impersonation, and related abuses. However, the CPPA cautions that "certain" online experiences – including targeted advertising and personalized content – may be affected as a result.

The Electronic Frontier Foundation has described data brokerage as an interconnected and opaque industry in which hundreds of companies generate billions of dollars by selling user data. While stronger privacy laws are likely the most effective way to rein in the practice, tools like DROP should make the process more manageable for everyday users.

Permalink to story:

 
Too bad it doesn't do the rest of us any favors. Services use your address to determine how much they're allowed to abuse you, or they ask for it when you submit a privacy request. Why? Because we don't seem to be worth protecting from these creeps at the federal level. Too many greased palms to grab onto meaningful legislation.

I hate talking politics, but these fools are drinking directly from the federal teet, paying no taxes, and then using that advantage to exploit consumers. That's the digital world currently. A surveilance economy where you cannot avoid silent corporate exploitation because you are forced by law to submit yourself to their margins. How free do you feel? Doesn't seem very democratic does it?
 
Of course, if the request simply serves to verify you were a “real person” and then one copy of your data gets deleted - and another copy goes on a list to sell to preferred advertisers… that wouldn’t be very helpful…

But that could never happen, right?
 
Whilst no doubt being well-meant, without doubt there will be plenty of loopholes for these scumbag companies and their overpayed lawyers to exploit.
For example: "Once verified, users can send deletion requests to data brokerage companies registered in California."
So, what is to stop aforementioned scumbags from transferring all California-harvested data to one of their (many, no doubt) partners-in-crime in a different state/country before said deletion requests pour in?
 
And the same people then go to Instagram, Facebook, TikTok, and post their most sensitive data and photos, and wonder why they are always targeted
 
California took a step in the right direction, but it's not enough. They needed to make it a criminal act for companies to posses personal info without good cause and allow for citizens to take civil legal action when a company is found to be in violation. This also needs to go nation wide.
 
Back