At last! California residents can block data brokers selling personal info

California’s Delete Act: A New Era in Data Protection

Data brokers have long been a thorn in the side of online privacy and security, scraping together personal information and selling it openly on the web. This not only poses a risk to individuals’ online safety but also to their real-world security. However, with the implementation of California’s Delete Act (SB 362), residents of the state can now breathe a sigh of relief. The law, which went into full effect on January 1, 2026, requires a system for residents to remove themselves from all data broker sites with a single request.

Passed in 2023, the Delete Act mandates that data brokers must register with the state, and as of now, over 500 data brokers are covered under this law. The state’s new DROP site (“Delete Request and Opt-out Platform”), available at https://privacy.ca.gov/drop/, allows California residents to opt-out of data broker sites with ease. To use the opt-out tool, residents must take three simple steps:

How to Use the DROP Opt-out Tool

To remove their information from data broker sites, California residents must:

1. Confirm their California residency.
2. Create a profile containing basic personal information.
3. File the DROP request, which will be sent to all 545 registered data brokers in California.

DROP requests became available on January 1, 2026, and data brokers must begin honoring these requests on August 1, 2026. They will have 90 days to remove all requested information and must delete data every 45 days thereafter.

State of California

A New Era in Data Protection

The Delete Act is similar to the United States’ national Do Not Call Registry, which allows individuals to block telemarketing calls with a single request. While this law currently only applies to California residents, it’s likely that other states will follow suit, as consumer protection laws in California often influence legislation in other states. For example, credit freezes originated in California and eventually became standardized across the U.S. after the 2017 Equifax hack.

The Delete Act is a significant step forward in data protection, as it simplifies the process of removing personal information from data broker sites. Previously, individuals had to play a game of “whack-a-mole,” constantly removing their information from one site only for it to appear on another. Now, with the DROP opt-out tool, California residents can remove their information from all registered data brokers with a single request.

As this law sets a precedent for data protection, it’s likely that other states will adopt similar legislation, providing individuals across the country with greater control over their personal information. With the Delete Act, California is leading the way in protecting individuals’ online privacy and security, and it’s a development that’s worth watching.