New year, new privacy rules. At least for Californians.
Since Jan. 1, residents of the Golden State can use a new tool to request removal of their personal information held by more than 500 data brokers.
The Delete Request and Opt-out Platform, or DROP, is a simple-to-use tool that lets people submit requests for their personal data to be scrubbed from databases.
It’s the first system of its kind in the United States, and launched after legislation that expanded consumer privacy rights and added obligations for companies.
Privacy advocates say DROP is a useful for helping people reclaim some of their privacy from the data broker industry, which collects scraps of personal information to sell for marketing and other purposes.
Here’s a guide to how it works:
Submit a request
Go to the official DROP website at privacy.ca.gov/drop. Read through the terms of use before accepting.
You’ll have two ways to verify you’re a California resident and set up your profile, either by filling in your personal information or by using a login.gov account.
Most people will use the first option, which requires name, date of birth and address, and a phone number or email address to receive a verification code.
If you opt to use login.gov, you’ll need to upload a copy of your passport, driver’s license or state ID.
Next, fill out your deletion request with your name, birthdate and ZIP code. You’ll also again need to provide a phone number or an email address, to receive another verification code.
Perhaps you went by a different name previously, such as a maiden name? You can add multiple versions of all the information types, except your birthdate.
“The more information you provide, the more likely your personal data will be deleted,” the DROP website says.
Identifiers
There are also fields to add a “unique identifier,” either in the form of a Mobile Advertising ID for iOS or Android devices, a connected TV ID, or a vehicle identification number, or VIN.
Android identifiers are found in the settings menu. Apple doesn’t allow users to find the code, but it can be turned off in settings. More information is available on the CPPA website.
Most people don’t have these numbers at hand. You can skip this section and add them later.
Timeline
While people can sign up now, data brokers won’t start deleting information until Aug. 1. After that they will process deletion requests every 45 days. Data brokers that fail to comply face fines of $200 a day.
Perhaps you moved to a new house or bought a new phone or car after you filed your request. You can always go back to your profile to update it with more information and submit a fresh deletion request at any time.
Data brokers
Data brokers are shadowy intermediaries that sweep up scraps of personal information about consumers and package them for sale in vast databases with millions of records, often without consent.
They data is bought from businesses that people deal with, scraped from websites or captured with tracking tools on mobile devices.
Buyers could include legit groups such as landlords and insurance companies, or “malicious actors” like fraudsters, hate groups, domestic abusers or hostile foreign governments, the California privacy watchdog says.
“While some of this data is used to provide you with personalized services such as targeted advertising, misuse of this data can lead to identity theft, stalking or other harmful outcomes,” it said.
Types of data
Personal information collected by brokers includes your online purchases, web browsing history, employment data and IP address. It could also include sensitive information like a social security or passport number, driver’s license, precise geolocation and info on health and sexual orientation.
Deletion requests will include any so-called “inferred preferences” — in other words, assumptions about what you might buy based on the data.
What’s not covered
Privacy experts welcomed DROP but noted some blind spots.
It only covers data brokers who are registered in California. Some categories of data are exempt like public records for car and real estate ownership or credit rating info.
Still, “it is a good step for people to take,” said Hayley Tsukayama, director of state affairs at the Electronic Frontier Foundation. She also noted that DROP focuses on deletion and opting out, “which is really important, but the law itself doesn’t address (data) collection that strongly,” in contrast with European Union privacy regulations known as GDPR that spawned browser cookie consent popups.
Benefits
People should see fewer things like spam texts or emails for lists they didn’t subscribe to, said Tsukayama. “That’s kind of my hope, because those are the sorts of things that are getting sold and that’s kind of the most tangible way to grasp what a data broker is.”
Another, less obvious benefit is cutting the amount of location or medical data floating around that could get fed into algorithms.
“For everyone’s privacy, I hope that data brokers would have less access to some of this sensitive information,” said Tsukayama.
___
Is there a tech topic that you think needs explaining? Write to us at onetechtip@ap.org with your suggestions for future editions of One Tech Tip.
Copyright © 2026 The Associated Press. All rights reserved. This material may not be published, broadcast, written or redistributed.
