California Takes Historic Action Against Data Brokers

SACRAMENTO — Data brokers are starting to delete Californians’ personal information, and the state is taking action against companies not complying with two of California’s landmark consumer privacy laws. Over 475,000 state residents have already requested their data to be deleted through California’s one-stop-shop tool for deleting personal information from data brokers, and the California Privacy Protection Agency Board recently issued a decision taking action against Iowa-based data broker LocateSmarter LLC after the company failed to timely register as a data broker and unlawfully required Californians to provide sensitive personal information, including partial Social Security numbers, before they could opt out of the sale of their personal information. Recent action supports enforcement of California’s privacy laws and holding data brokers accountable.  

In 2023, Gov. Newsom, with the Legislature, enacted the Delete Act — that gives Californians more control over their data and the ability to tell data brokers to stop selling their personal information. As of Jan. 1, 2026, Californians can submit a single deletion request to registered data brokers through the Delete Request and Opt-Out Platform or DROP. DROP verifies the user’s California residency and then transmits the deletion request to the data brokers. The Delete Act requires data brokers to register with CalPrivacy, California’s Privacy Protection Agency, annually in January and pay a fee that funds the Data Broker Registry and DROP. As of August 1, 2026, data brokers are required under the Delete Act to begin processing deletion requests.

DROP helps give Californians better control over their data and simplifies the process of requesting that data brokers stop sharing and selling their data. Previously, consumers had to make requests to each data broker individually, making the process extremely difficult and time-consuming.

Details: https://privacy.ca.gov/drop/.