California Privacy · 2026

California DROP Act 2026: How to Remove Personal Information From Data Brokers. explained clearly.

A practical guide to California's DROP system, data-broker deletion requests, timelines, eligibility and how privacy cleanup fits into online reputation management.

At a glance

Start with the actual california privacy · 2026 search problem.

California's Delete Request and Opt-out Platform (DROP) changes how eligible residents can request deletion of personal information held by registered data brokers. Starting August 1, 2026, covered data brokers began processing DROP requests on a recurring schedule. This guide explains what DROP does, what it does not do, how the process works, and how data-broker removal fits into a broader personal privacy and online reputation strategy.

Practical guide

What to consider.

01

What is California DROP in 2026?

California's Delete Request and Opt-out Platform, known as DROP, gives eligible California residents a centralized way to ask registered data brokers to delete and stop selling their personal information. Instead of contacting hundreds of data brokers one by one, a consumer can submit one request through the state platform. The California Privacy Protection Agency says DROP can send a request to more than 600 registered data brokers. This makes DROP an important development for people who are trying to reduce the amount of personal information available through data-broker ecosystems. It is also relevant to online reputation work because information collected by brokers can appear in people-search services and other public-facing databases.

02

Who can use the DROP system?

DROP is designed for California residents. The official California Privacy Protection Agency platform verifies eligibility before a request can be submitted. Consumers can provide basic identifying information so participating data brokers can match the request to records they maintain. The platform is free to consumers. If you are outside California, DROP is not a general U.S. data-removal service; other privacy laws and individual data-broker opt-out procedures may apply instead. For a reputation or privacy campaign, the first step is therefore to identify the person's location and the exact sources displaying the information.

03

What information can be used to match a request?

The DROP system can use several identifiers, including name, date of birth, ZIP code, email address, phone number, mobile advertising ID, connected TV identifier and vehicle identification number. The state advises that providing additional optional information can improve the likelihood that a data broker will match the request to its records. Consumers should still provide only information they are comfortable submitting through the official system. DROP uses hashing and other privacy protections to process requests, and the official platform explains how submitted information is handled.

04

What changed on August 1, 2026?

The important operational date for 2026 was August 1. Starting that day, data brokers covered by the system must access DROP and process deletion requests at least once every 45 days. The California Privacy Protection Agency explains that brokers download deletion lists, standardize and hash their records, match requests, delete eligible information when a match is found, and report the request status. Consumers may need to wait before every result is visible in the platform. CalPrivacy states that it can take up to 90 days for a consumer to see status updates.

05

What happens after you submit a DROP request?

After submitting a request, the consumer receives an eight-digit DROP ID that can be used to check status. Data brokers may report statuses such as Deleted, Exempted, Opted-out or Record not found. A record not found result does not necessarily mean that every other broker has no information; it only describes that broker's matching result. Some information may also be legally exempt from deletion. The system is ongoing rather than a single one-time cleanup: data brokers are required to repeat their processing cycle at least every 45 days.

06

What does DROP actually remove?

DROP is focused on non-exempt personal information held by covered data brokers. That can include information and inferences maintained by a broker, subject to the applicable legal exemptions. DROP does not mean that every web page containing a person's name disappears from Google. First-party information that a consumer directly provided to a business, publicly available information and legally exempt information can fall outside the deletion mechanism. This distinction matters for reputation management: data-broker deletion and Google search-result removal are related but separate problems.

07

DROP versus Google search-result removal

A person may have two different problems at the same time. The first is that a data broker has personal information in its database. The second is that a search engine indexes a page containing that information. Using DROP addresses the first problem for covered data brokers; it does not automatically remove independent web pages or search results. If a harmful or outdated page remains visible in Google, the appropriate strategy may involve a legitimate source-level removal or correction request, de-indexing where an applicable process exists, or search-result suppression. Our <a href="/services/negative-search-result-removal">negative search result removal service</a> explains the distinction.

08

How DROP fits into personal reputation management

Personal reputation management often requires a broader search audit. A campaign may identify people-search profiles, data-broker pages, old profiles, news coverage, directory records and other results that expose personal information. DROP can be one component of the privacy and data-removal workflow for an eligible California resident. It should not be presented as a universal solution for every negative result. Our <a href="/services/online-reputation-repair">online reputation repair service</a> and <a href="/services/data-broker-removal">data broker removal service</a> can be used as the commercial paths when the issue extends beyond the state platform.

09

Why data-broker removal matters for search visibility

Data brokers can distribute information across multiple people-search and identity databases. When similar information is repeated across sources, a person may have difficulty keeping an accurate and controlled public profile. Removing eligible information from covered brokers can reduce one part of that ecosystem, although results vary by source and by the information a broker actually holds. For SEO and reputation work, the useful approach is to map the sources first, then determine which can be addressed through privacy rights, publisher requests, platform processes or search suppression.

10

What California residents should check before submitting

Before starting, confirm that you are eligible to use DROP and use the <a href="https://privacy.ca.gov/drop/">official California DROP platform</a> rather than an unofficial form. Make a record of the important personal information you are trying to remove, the people-search sites where it appears, and any relevant URLs. Save your DROP ID after submitting. It is also useful to keep a baseline of the search results before the cleanup so you can distinguish a data-broker deletion from a change in Google visibility. Do not assume that a successful DROP request means every search result about you will disappear.

11

How to handle information that remains online

If information remains after a data-broker request, identify why it remains before choosing the next action. It may come from a first-party business, a news publisher, a public record, a social profile, a forum, a directory or another source outside DROP. Different sources have different correction and removal procedures. When removal is not available, search-result suppression may involve creating and strengthening useful, authoritative pages that can compete for the relevant searches. Our <a href="/services/search-result-suppression">search result suppression service</a> covers that separate strategy.

12

A practical 2026 California privacy and reputation checklist

A useful workflow is: confirm California eligibility; submit the official DROP request; save the DROP ID; record the people-search and data-broker sources already visible; check the status as brokers process requests; identify information that remains outside the system; pursue legitimate publisher or platform correction and removal opportunities where appropriate; and monitor Google and other search results over time. If the remaining problem is a negative or outdated search result rather than a broker record, treat it as a separate search-reputation issue rather than repeatedly submitting the same privacy request.

13

What businesses should know about the 2026 DROP process

Businesses that qualify as data brokers have their own obligations under the Delete Act and DROP rules. CalPrivacy states that covered data brokers must create accounts, register when applicable, and process consumer deletion requests beginning August 1, 2026. They must access DROP at least once every 45 days and report request statuses within the required cycle. This article is written primarily for consumers and reputation-management research, but understanding the broker-side process helps explain why deletion status can take time and why results can differ between brokers.

Related services

Build the right reputation strategy.

For a California privacy and reputation audit, map the personal information sources first, then separate data-broker deletion, publisher correction, search-result removal and suppression into the appropriate workflows.

Common Questions

Questions about California Drop Act Data Broker Removal

Can removing a source also remove it from Google immediately?

Not always. Search-index updates can take time, and a separate search-result process may apply depending on the circumstances.

Are data brokers handled differently from ordinary websites?

Yes. Data brokers often have dedicated opt-out or deletion processes, so the source's own privacy workflow should be checked first.

How should privacy cleanup be monitored?

Recheck the affected URLs and important name, address or phone searches periodically to identify reappearance or new sources.

What should be identified before personal-information removal?

Map the exact URL, exposed data, source type, search query and responsible website so the appropriate privacy or removal route can be assessed.