California Launches DROP Platform for Data Broker Opt-Outs
California residents can now use the state-run DROP platform to easily submit deletion and opt-out requests to registered data brokers, streamlining privacy control.
California has officially launched the Delete Request and Opt‑out Platform (DROP), a new state-run portal designed to empower residents in managing their personal data held by data brokers. This initiative, born from the California Delete Act, mandates that over 600 registered data brokers must comply with deletion and opt-out requests submitted through the platform within 90 days.
Data brokers, entities that collect and sell vast amounts of personal information—ranging from financial details and online behaviors to precise location data—often gather this information with limited transparency or explicit consent. The DROP platform aims to standardize and simplify the process for Californians to exercise their privacy rights, a significant improvement over the manual, individual requests previously required for each broker.
To utilize DROP, residents must first verify their identity and residency within California. This can be achieved by providing personal information manually or by authenticating through Login.gov. Once verified, users can initiate a deletion or opt-out request by providing contact details such as an email address or phone number. The platform then uses this information, along with basic personal data like name and address, to help brokers locate and remove or stop the sale of the individual's records.
After a request is submitted, users receive a unique DROP ID to track the status of their request online. Registered data brokers are then legally obligated to process these requests within a 90-day timeframe. The California Privacy Protection Agency (CPPA) oversees the registration of data brokers and enforces compliance with the Delete Act, with non-compliant brokers facing potential fines.
For individuals residing outside of California, the process of opting out of data broker collection remains more manual. States like Oregon and Texas also have data broker registration requirements, but they typically lack a centralized portal like DROP. Residents in these states, or those seeking to manage their data in states without such platforms, must navigate to individual data broker websites or consult their state's attorney general for guidance on submitting direct requests.
Even without a centralized platform, US residents can still reduce data broker collection by identifying brokers through online searches and privacy advocacy group lists. This involves submitting individual opt-out and deletion requests directly to each broker, often through web forms or email, and meticulously tracking responses and deadlines, which vary by state but are commonly between 30 to 45 days.
To further mitigate future data collection, users are advised to employ strategies such as using disposable or alias email addresses for non-critical registrations, utilizing VPNs to mask IP addresses and encrypt traffic, and being judicious about the personal information shared with services, especially loyalty programs or non-essential accounts. Reducing the amount of readily available personal data makes it harder for brokers to build comprehensive profiles.
The introduction of DROP represents a significant step forward in consumer privacy rights within California, offering a more accessible and efficient mechanism for residents to control their digital footprint and limit the pervasive sale of their personal information by data brokers.