California DROP & Data Deletion
California launched DROP (Delete Request and Opt-Out Platform) to streamline requests to registered data brokers. MyDataKey complements government tools by adding verification, continuous oversight, and ownership records across jurisdictions and industries.
1) Centralized Deletion (California Residents)
DROP lets California residents submit a single request that is delivered to all registered data brokers in the state. Important: data brokers are not required to begin processing DROP requests until August 1, 2026.
What DROP Covers
- California residents requesting deletion from registered data brokers
- Broker retrieval cycles: brokers must access DROP at least every 45 days
- Deletion timing: deletion must be completed within 90 days of retrieval
- Continuous deletion: brokers must periodically delete newly acquired personal information (45-day cycles)
What DROP Does Not Provide
- Coverage for non-broker companies (retailers, apps, SaaS, employers, many platforms)
- Coverage outside California
- End-to-end proof that deletion occurred everywhere your data traveled
- Ongoing monitoring across ad-tech, processors, affiliates, and downstream recipients
- Ownership records, asset treatment, or enforcement escalation artifacts
3) Direct Requests (Non-CA Residents & Non-Broker Companies)
If you are not a California resident, or the company is not registered as a California data broker, you typically must submit requests directly to each company.
- Methods: companies commonly provide at least two request methods (webform, email, or phone).
- Privacy policy: look for “Do Not Sell or Share My Personal Information” and related rights links.
- Verification: many companies require identity verification before processing deletion.
4) Credit Reporting & Financial Data (FCRA)
Credit bureaus are largely regulated by federal law (FCRA), which often changes the deletion pathway. Consumers typically use a mix of opt-outs and freezes rather than “state deletion” alone.
- Marketing opt-out: prescreened credit/insurance offers opt-out pathways.
- Security freeze: freeze credit reports to limit new-lender access without consent.
- Trigger leads: restrictions begin March 5, 2026, limiting sale/use of certain “trigger leads” without a pre-existing relationship.