DROP Data Broker Deletions, How Do They Work?

Key Takeaways:

• California’s new DROP system lets consumers send one request to over 600 data brokers to delete and stop the sale of their personal information.
• When you enter your information into DROP, it’s immediately encrypted using hashing, so your raw data is never stored or shared.
• Starting August 1, data brokers must download these hashed requests, match them to their records, and delete any matching personal information within 45 days.
• You can track your deletion status using your DROP ID; results may vary depending on what information you provided and what brokers have in their records.
• Adding more optional details (like a mobile advertising ID or VIN) can improve matches, and submitting a DROP request takes less than 10 minutes at Privacy.ca.gov/DROP.

This year, on January 1, CalPrivacy launched the Delete Request and Opt-out Platform (DROP) — a first-of-its-kind system that allows California consumers to send a request to over 600 active data brokers telling them to delete and stop selling their personal information. Data brokers are businesses that gather and sell consumer personal information that the consumer didn’t give them directly.

Since launch, we’ve had over 325,000 consumers sign up for DROP and submit deletion requests. Now, the countdown to August 1 is underway, when data brokers must begin to retrieve and respond to consumers’ deletion requests. You can sign up and submit your deletion request at Privacy.ca.gov/DROP.

How Deletions Work

If you’re a curious consumer, you might wonder what happens when you submit a DROP request. The process is built around a number of privacy-by-design elements central to DROP, including the use of an information protection technique called “hashing.” When you enter your personal information into DROP, it instantly “hashes” your data, a form of encryption that scrambles your entry into a series of random numbers, letters, and symbols. This helps keeps your data secure because no raw personal information is stored in DROP or ever shared with data brokers.

Starting on August 1, data brokers must download the hashed deletion requests and compare them against the personal information in their records. To do this, data brokers must first standardize and hash their own data before comparing it to the data you submitted in your deletion request to see if it matches.

If a data broker finds a match between the information in your deletion request and information in its own records, the data broker must delete all of your information on a rolling 45-day basis, subject to some exemptions. You only need to submit your DROP request once, and data brokers must ensure your information remains deleted should the data broker collect it again in the future.

DROP Statuses 

Once deletions begin, you can check the status of your deletion request by entering your eight-digit DROP ID. Not every data broker will have your information, so what you see may vary by data broker. DROP statuses include:

• Record deleted — Data brokers have matched your personal information from DROP to personal information in their records and deleted any non-exempt personal information they hold about you.
• Record exempted — Data brokers have matched your personal information from DROP to personal information in their records but are permitted by law to keep it.
• Record opted out of sale— Data brokers found multiple consumers associated with the personal information you provided through DROP. These data brokers still may have your data, but can no longer sell or share it.
• Record not found — Data brokers may not have information about you or did not find a match between the personal information you provided in DROP and the personal information in their records.
• Pending — Data brokers haven’t processed your deletion request yet.

Data brokers are required to begin accessing DROP to download and process deletions requests beginning August 1.  If your drop request status is “pending”, check back soon! Status updates can take up to 90 days to show up in DROP.

Add More Personal Information for Better Results

The specific results you see for your deletion request may vary based on the information you included in your request and what data brokers have in their records. The more information you enter, the more information data brokers will have to compare and look for matching records. For better results, you can update your DROP profile to provide more information, like a new email address or filling in a blank field. A few optional fields that can help boost your results are adding your mobile advertising ID, connected TV ID, and vehicle identification number.

Submit your request by visiting the DROP webpage, and in less than 10 minutes you can verify your eligibility as a California resident, create your profile, and submit your DROP request. We’re all looking forward to even greater privacy for California consumers as data brokers begin accessing the DROP.