DROP FAQ: 10 Common Questions about DROP

1. I want to submit a DROP request. Why do I have to enter and verify some of my information twice?

You must enter and verify some of your information twice because DROP involves a two-step process: residency verification and submitting your deletion request.

The first step of submitting a DROP request is verifying your status as a California resident. By law, DROP is for California residents only.

Residency verification is independently done via the California Identity Gateway, a system operated by another state agency (the California Department of Technology). DROP only stores whether the California Identify Gateway has verified that you are a California resident — it does not hold onto the personal information you submit to verify your residency.

The second step is filling in your DROP request. You may be prompted to enter and verify some of the same information, like your phone number and email address, to complete this step. This is required since DROP does not store the information you entered to verify your residency.

2. Why does DROP collect my personal information if data brokers may already have it? Do you really need all this information?

DROP collects a few basic identifiers (e.g., phone number, email address, etc.) to make it possible for data brokers to locate your personal information in their records.

Your first and last name alone, for example, may not be enough information for a data broker to find and delete your specific record. As mentioned above, DROP also asks for your phone number and email address, which are common identifiers that data brokers use to identify you in their records.

Some data brokers also collect information about you based on your devices (e.g., phones and TVs) as well as your vehicles. So that is why DROP also asks for optional unique identifiers such as your Mobile Advertising ID (also known as a “MAID” which can uniquely identify your phone) as well as your Vehicle Identification Number (also known as a “VIN” that identifies your car). But it is completely optional to put these identifiers into DROP, and you can later come back to DROP and add these identifiers if you don’t have them handy when you initially use DROP. DROP doesn’t require these optional identifiers to work – but adding more identifiers can help increase the chances that a data brokers finds and deletes your information.

3. How is my data stored once I submit a DROP request, and who inside the State can access it?

Your personal data is made inaccessible to anyone in the State as soon as you enter it into DROP, through a method known as hashing. Hashing involves re-writing your information into a scrambled code. When data brokers go through the process of matching their records to data inside DROP, they use the same hashing mechanism, and only if a match exists do they know whose records to delete.

4. What is a MAID? Is it necessary for my request?

As mentioned above, a MAID is a Mobile Advertising ID. You do not need to enter a MAID to submit a DROP request. Please review CalPrivacy’s guide to understanding MAIDs. Keep in mind, some operating systems automatically disable tracking through MAID on your device.

5. What is my DROP ID? If I lose my DROP ID, can I request it again?

Your DROP ID is an 8 to 10 character code that allows you to review and edit your DROP request. This is provided after you submit your DROP request. Use your DROP ID to check the status of your DROP request at any time.

Since your DROP ID provides access to review and edit your DROP request, it is important to never share your DROP ID with others.

If you lose your DROP ID, you can request to recover it.

6. Is DROP effective?

Over 550,000 Californians have signed up for DROP as of the beginning of October 2026. In the first three months, since deletion request processing started on August 1^:

• 99% of consumers had their information deleted by at least 1 data broker
• 70% of consumers had their information deleted by 100+ data brokers

7. I see some of my information was deleted but some wasn’t. What do these statuses mean?

After a data broker processes deletion requests, they report back to DROP with the results of each record they process. This process can take up to 90 days from the time you submit your request.

These results appear to you as a “status” — i.e. a status update about your DROP request. These statuses are separated into five categories: “deleted,” “exempt,” “opted-out,” “record not found,” and “pending.” You can learn more about what each status code means by reading our blog post on DROP data broker deletions.

It is normal to see a variety of status codes on your DROP request. Not every data broker has information about you and so they may report a status code of “record not found” for your DROP request. There may also be data brokers who have information about you that is exempt from deletion under the Delete Act. Common examples of this include information that you provided to them directly, or information that is publicly available, like information from a public record.

8. If a data broker gets my information again, do I need to submit another request?

You only need to submit your DROP request once, and data brokers must honor the request on an ongoing basis.

If a data broker doesn’t find your information today, they must continue to check your information against their records as they acquire more data. So, a “record not found” status today could change to “deleted” a year from now. Use your DROP ID to check status regularly.

9. What happens if a data broker doesn’t comply with the law — are there real penalties?

The fine is $200 a day per consumer for failure to delete information as required by law, plus CalPrivacy’s cost of investigation and administrative enforcement action. The potential penalties are real. Compliance with the Delete Act is required by law and enforced by CalPrivacy.

10. I submitted my DROP request and am ready to do more to protect my privacy! What else can I do?

Submitting your DROP request is a great first step! For more information about how to further protect your privacy and exercise your privacy rights you can visit our privacy tips page.