DROP for data brokers
DROP allows California residents to submit a single deletion request to all active data brokers to request the deletion of their personal information. Data brokers must access DROP and process these deletion requests beginning August 1, 2026.
Under the Delete Act and its implementing regulations, data brokers must use DROP to
- Create an account,
- Pay access or registration fee, depending on when you began brokering data
- Register annually (when applicable)
- Process DROP requests within the required timelines.
January 2026
- Consumers can now submit DROP requests
- Data brokers start creating DROP accounts and register (if applicable)
March 2026
DROP Sandbox available for testing
August 2026
- Data brokers must begin processing DROP requests
- Consumers begin to see status updates in DROP
DROP sandbox available. To test now, log in.
Overview
By law, a data broker is a business that knowingly collects and sells to “third parties the personal information of a consumer with whom the business does not have a direct relationship” (Civ. Code § 1798.99.80(c)).
Getting started
Here’s some information to help data brokers get started in DROP.
1. Create a DROP account
Data brokers must create an account if they:
- Operated as a data broker in 2025
- Started brokering the data of California residents between January 1 and August 1, 2026
- Plan to begin operating as a data broker after August 1, 2026
Follow these steps:
- Create an account in DROP.
- Wait for approval from CalPrivacy. This should take no longer than two business days. You will be automatically notified of your approval by email.
2. Complete registration
Data brokers must register with CalPrivacy following each year in which their business meets the definition of “data broker” (Cal. Civ. Code § 1798.99.80). For example, data brokers that operated in 2025 must register in 2026.
During annual registration, data brokers will:
- Fill out the registration form with information about your business
- Respond to annual disclosure requirements
- Pay the annual registration fee. This year’s fee is $6,000 plus an associated third-party processing fee for electronic payments.
The registration form consists of multiple steps, and your progress will be saved as you go.
3. Process DROP requests
Starting August 1, 2026, data brokers must begin processing DROP requests at least once every 45 days.
To process DROP requests, data brokers will:
- Download consumer deletion lists
- Standardize and hash their own consumer records
- Match and process requests
- Report the status of each request in DROP within 45 days
Review Processing DROP requests for more details. For technical requirements, review Technical specifications.
Penalties
If you do not comply, you may face penalties.
Registration
$200 per day
for failure to register
Fine for data brokers who miss the January 31 registration deadline plus CalPrivacy’s cost of investigation and administrative action
Request processing
$200 per day
per deletion request
Fine for each day a broker fails to delete information as required under Delete Act plus CalPrivacy’s cost of investigation and administrative action