California residents, who since 2020 have been able to request companies to stop collecting and selling their data, will gain access to a new centralized mechanism with the launch of the Delete Requests and Opt-Out Platform (DROP). The platform allows residents, after verifying their state residency, to submit a single deletion request that will be automatically forwarded to more than 500 registered data brokers.
However, the platform will not operate immediately: it is expected to go live in August 2026, with an additional period of up to 90 days for companies to locate records, delete information, and confirm compliance with the request.
The legislation also establishes relevant legal limitations. Organizations may retain primary data collected directly from their own customers, and the deletion obligation applies exclusively to companies whose business model involves buying, aggregating, or selling personal information, a market that includes information such as social security numbers, browsing history, email addresses, phone numbers, and other identifiers. Additionally, some types of information are exempt from deletion requirements, such as public vehicle records and voter registrations. According to the California Privacy Protection Agency, the new platform could significantly reduce unsolicited calls, messages, and emails, as well as risks of identity theft, fraud, AI-enabled scams, and data breaches.