Hi CIPAWorld!
As 2026 gets going, so does a new ability for consumers in California to remove their data from a variety of data brokers paving the way for an individual to have greater control over how their information is handled and sold.
The Delete Request and Opt-Out Platform (“DROP”) was created under the California’s Delete Act (SB 362) allowing for a centralized system for a California resident to request deletion of their information from all registered data brokers. As a brief reminder, remember that SB 362 defines a data broker as any business that “knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” These companies usually exchange such data with other entities for targeted advertising. As a consumer, it is very difficult (to put it mildly) to track all the avenues that one’s information is being shared. Up to now, many would have had to go to each specific website that they were aware that they were selling or exchanging their data and request to have their information deleted. But now what is fascinating is the fact that not only does DROP allow for consumers in California to have their information removed from these data brokers, but it does so with a single request. This is profound given not only the time and hassle that it would save the individual from having to opt-out on every website or business they’ve possibly interacted with, but the efficiency and simplicity of allows for the process to be streamlined even faster.
To use this feature, all California residents have to do is confirm they are a resident of the state, create a profile and submit your request. That’s it, that’s the entire process. For the system to confirm that you are a California resident, besides the usual basic information (name, date of birth, zip code, email address and phone number), some additional that might help may identifiers such as one’s vehicle identification number (VIN) and Mobile Advertising ID (MAID). MAID are simply a “unique identifiers that is assigned to a specific mobile device such as a phone or tablet that allows data brokers to track a user’s activity within apps and across different platforms for targeted advertising purposes.” For the layperson, all this refers to are those tracking components that are either enabled or disabled when one’s beings a new application on the firm and the pop up “Ask App Not To Track” appears. The DROP mechanism allows California consumers to keep the request broad to have all data brokers remove their information or narrow the list of entities they want their data to be removed from. Once the person completes this step, creates a profile and submits their request, they are done. It really is that simple.
Once the request is submitted, the DROP request will go to the data brokers and they must begin processing requests starting in August 2026. Data brokers will begin searching their database based on the information provided and if they find a match, they will delete all of the information they can about that person and not just what was provided in the request! This is important because this includes any sensitive and inferred information the entities may have about the person. Data brokers have up to three months to process the requests and provide the consumer with an update as to their request. The only “downside” here is that the person may affect certain online experiences such as fewer targeted ads or personalized content. I would wager no one would be too upset about that though so not really of a downside anyhow.
To provide more transparency to the consumer, on the profile the individual created, they will receive DROP status updates notifying them of the status. The statuses include deleted, exempted, opted-out, record not found or pending. Per the privacy.ca.gov website, they define each status as follows:
“Deleted – Data brokers have deleted your data and will no longer sell your information. However, they are allowed to keep some information because that is exempt by law.
Exempted – Data brokers are allowed by law to keep the information they have about you because it is all exempt. This data can include public records or certain health information, but it may still be protected under other laws.
Opted-Out – Data brokers couldn’t make an exact match based upon the information you provided. For now, these data brokers still have your data, but can no longer sell it.
Record Not Found – Data brokers may not have information about you or could not locate you based on the information you provided.
Pending – Data brokers haven’t processed your deletion request yet. Under the law, data brokers may take up to 90 days to report back how they processed your request.”
Lastly, as data changes and data brokers obtain more information, so can the California resident in order to ensure their new (or updated) information is not resold without their consent or awareness. The individual is allowed to return to their profile and update their information as necessary. Only thing to note is that data given directly to a business (known as first-party data), exempted data and publicly available data will not be available.
While the DROP mechanism may not be a foolproof system (or may be it is but only time will tell), this feature provides California consumers with some more control over how their personal information is distributed, sold and exchanged with various entities. It is too early to tell how effective it will be as data brokers will only begin processing requests in August of this year but it is a step in the right direction for the public. At the very least, one should drop everything they’re doing (pun may or may not be intended) and be sure to take advantage of this feature.
I will keep my eyes on this as the year goes on and see the progression (or lack thereof) of the DROP’s mechanism and will report back when I learn more.
Talk to you soon CIPAWorld!
CIPAWorld 