California Residents Can Use New Tool to Demand Brokers Delete Their Personal Data

California is offering residents a new tool that should make it easier for them to limit the ability of data brokers to store and sell their personal information.

While state residents have had the right to demand that a company stop collecting and selling their data since 2020, doing so required a laborious process withdrawal with each individual company. The law on suppression, adopted in 2023was supposed to simplify things, allowing residents to make a single request to have more than 500 registered data brokers delete their information.

Now the Deletion requests and unsubscribe platform (DROP) actually gives residents the opportunity to make this request. Once DROP users verify that they reside in California, they can submit a deletion request which will be sent to all current and future data brokers registered with the state.

But this doesn’t necessarily mean that all your data will be deleted immediately. Brokers are supposed to start processing applications in August 2026, then they have 90 days to actually process applications and report. If they do not delete your data, you will have the opportunity to submit additional information that could help them locate your records.

Businesses will also be able to retain first-party data they have collected from users. Only brokers looking to buy or sell this data – which may include your social security number, browsing history, email address, phone number, etc. – will be required to delete them.

Some information, such as vehicle registration and voter records, cannot be removed because it comes from public records. Other information, such as sensitive medical information, may be covered by other laws like HIPAA.

The California Privacy Protection Agency says that in addition to giving residents more control over their data, the tool could lead to fewer “unwanted texts, calls or emails” and also decrease the “risk of identity theft, fraud, AI impersonation, or having your data leaked or hacked.”

The penalty for data brokers who fail to register or delete requested consumer data is $200 per day, plus enforcement fees, according to the agency.