Over Half a Million Californians Have Signed Up to Delete Their Info From Data Brokers. Here’s How You Can, Too

And while Kemp acknowledged that the long-term effects of the law might “take a couple years to see” — for example, if elder fraud will go down in California as compared with other states — it’s nonetheless “one big step in the right direction,” he said. (In fact, news outlet CalMatters recently announced a crowdsourced effort to track DROP’s progress.)

Keep reading for an overview of the DROP law, from what it does to how to submit a request yourself.

The state also has its own thorough resource on navigating DROP, including what it means to delete your personal data. Be sure to also check out KQED’s guide on more ways to protect yourself online.

How you can use DROP

Who can submit a DROP request?

You can use DROP if you are a California resident and must verify that you are a California resident when you fill out the form by either:

• Providing personal information, including name, date of birth, address, phone or email. If you cannot provide a phone number or email, you may need to provide a Social Security number or Individual Taxpayer Identification Number. You will give this information on a state website called the California Identity Gateway, which is often used to verify residency. According to the state, this information will be used only to verify your identity and residency and will not be stored or shared.
• Creating an account through login.gov, a “federally hosted identity verification service used by many government agencies.”

Keep in mind that if you choose to verify either through the California Identity Gateway or login.gov, you will need to use the same method for future DROP requests.

Once your identity is verified, you will be able to proceed with the submission form on the DROP website.

How can I submit a DROP request?

You can submit a request using the state’s official DROP website.

After verifying you’re a California resident (see above), you’ll fill out some basic information, including:

• Full name (including any other variations of your name, like a maiden name or nickname)
• Date of birth
• Zip code(s)
• Email address(es), which you’ll be asked to verify by code
• Phone number(s), which you’ll be asked to verify by code
• Any unique IDs you have connected to your phone or smart TV since, according to the form, “Data brokers may use these IDs to track your habits and sell or share your data.” The Markup has a guide on finding some specific IDs, like advertising IDs, on your smartphone.
• Vehicle Identification Number (found on your car’s registration documents)

According to the DROP form, the “more information you provide, the more likely your personal data will be deleted.”

The entire process — if you have these unique numbers on hand — takes under 10 minutes.

Applying through DROP will be a lot quicker than the usual deletion process available to you, in which users had to contact each company individually to have their information removed — or pay for a service to do it in bulk. And investigative reports also show that the success of finding those deletion requests can vary.

After submitting the form, you will receive a DROP ID. You should save this ID, and you can use it to track the state of your deletion request.

According to the state’s DROP website, the information you put in the form “won’t be sold or shared for any other reason.” The state’s website explains how it encrypts input data and what data brokers see in your requests.

Does submitting a DROP request cost anything?

No. Submitting a DROP request is free.

Can I submit a DROP form for someone else?

Yes, you can submit a request for another person, like your child or your parent. The person must still be a California resident, and they must have given you permission to submit the DROP request for them.

If you are submitting a form for another person, you must use their details when verifying California residency, not your own.

After filling out the other person’s information, you will then need to provide your full name and your email address.

How does DROP work?

What data of mine will be deleted as part of DROP?

The new DROP law means that data brokers are now required by law to start clearing their records every 45 days, as of August.

But there is a chance that your data may be deleted even earlier. According to Kemp, “a lot of these data brokers have already reported back, and so far about 25% of the data brokers have said that they did the deletion matching.”

In addition to your phone number, this information about you that data brokers must begin to delete may include your:

• Name
• Birthday
• Address
• Email address
• Geolocation
• Health data
• Interests, such as your political party affiliation or your hobbies.

There are exceptions to what data these brokers must delete: For example, publicly available information (like a court appearance or property records) will not be deleted under DROP.

Where will the data be deleted from?

According to the DROP form, “All current and future data brokers who register with CalPrivacy are included in your deletion request.”

You can check out the list of over 600 active data brokers on the DROP website, and even directly opt in for the ones you actually wish to be listed on.

The DROP website also allows you to look at these data brokers individually and see what kind of data they’re gathering, like reproductive health information and biometric data. In some cases, you can also see where your data is being sold to, like developers of generative AI — or the federal government.

Nonprofit groups like charities may have your information, Kemp explained. But these are not required to be part of the registry of data brokers, which are for-profit companies.

The registry doesn’t just include data brokers based in California; it applies to companies out of state as well, said Kemp.

“As long as there’s a company that has a lot of Californians’ data that they collect and sell and they don’t have that direct relationship, they have to register,” he said.

Keep in mind: According to the state website, deleting your information could lead to a less personalized web experience, like targeted ads.

How long will it take for the data to be deleted?

After you apply for DROP, you’ll then have a personal DROP profile online — which you can periodically check for updates on your digital privacy.

And now that the deletion process has started, you’ll likely begin to see updates from brokers to your requests on your DROP profile.

The possible status updates are:

• Deleted: Your data is deleted and will not be sold.
• Exempted: Your data is allowed to be kept because it is exempted by the privacy law, such as a court or public record.
• Opted-out: Data brokers couldn’t find the exact information you input.
• Record not found: Data brokers could not find the information at all.
• Pending: Your deletion request is still being processed.

You may need to provide more information or take extra steps if data brokers are unable to fulfill your request.

Data brokers are required to delete information every 45 days and take up to 90 days to give an update.

Kemp said that the state does plan to “vigorously enforce this” and, “if a data broker is not properly doing the deletions, or ignoring the deletions, the fines are $200 per day per record.”