California’s data deletion law hits snags as brokers deny requests

California's DROP platform, launched under the DELETE Act (SB 362), represents a groundbreaking centralized system that allows residents to submit a single deletion request reaching over 500 registered data brokers simultaneously. This state-run portal, managed by the California Privacy Protection Agency, has already processed more than 300,000 deletion requests, marking a major milestone in consumer privacy by standardizing and streamlining data deletion across a previously opaque industry. Unlike other states where consumers must opt out individually with each broker, DROP consolidates this process, empowering Californians with unprecedented control over their personal information.

Starting August 1, 2026, registered data brokers in California face stringent legal obligations to comply with deletion requests submitted through DROP, including mandatory checks of the platform at least every 45 days and deletion of both raw and derived personal data within 90 days. Failure to comply triggers severe financial penalties of $200 per day per unprocessed request, with potential fines escalating into the billions, underscoring the DELETE Act's robust enforcement framework. This regulatory rigor signals California's commitment to holding data brokers accountable and ensuring sustained consumer privacy protections, further reinforced by independent audits beginning in 2028.

While DROP significantly advances consumer privacy by targeting over 500 registered data brokers, it notably excludes major data holders such as credit bureaus, banks, healthcare providers, and companies with which consumers have direct relationships. This limitation highlights that DROP's scope, though expansive within the data broker ecosystem, does not yet encompass the full spectrum of entities managing personal data. Nevertheless, by centralizing deletion requests and imposing strict compliance mandates on brokers, California sets a pioneering example that could influence broader reforms in data privacy governance.

To utilize the DROP platform, California residents must verify their identity and residency by providing at least one reachable email address or mobile phone number alongside basic personal details, enabling data brokers to accurately locate and delete their records. This verification process balances accessibility with security, ensuring that deletion requests are legitimate while facilitating consumer empowerment. The platform’s design reflects a thoughtful approach to privacy management, positioning California as the first state to offer such a centralized, government-run tool for data deletion, contrasting with the fragmented opt-out systems in states like Oregon, Texas, and Vermont.

By mid-2026, CalPrivacy has escalated enforcement against data brokers with a rigorous framework mandating the processing of over 300,000 deletion requests from more than 522 registered brokers by August 1, 2026. The Delete Act imposes strict deadlines—processing requests every 45 days and deleting data within 90 days—with a steep penalty of $200 per day for each unprocessed request, underscoring the agency's no-tolerance stance. Furthermore, CalPrivacy’s plan to initiate independent audits starting in 2028 signals a commitment to sustained oversight beyond immediate compliance, reflecting the long-term regulatory vigilance required in this evolving landscape.

The enforcement landscape is complicated by the challenges data brokers face in meeting stringent verification and reporting standards, as evidenced by companies like VisitIQ and HealthWise Data denying a large portion of deletion requests—over 270,000 and 88,000 respectively—raising alarms about the reliability of self-reported compliance. With the Delete Request and Opt-Out Platform (DROP) amassing over 350,000 users, brokers are under intense pressure to comply within 45 days or face substantial fines, yet operational hurdles and high denial rates have prompted privacy advocates to call for stricter oversight, emphasizing that brokers cannot be trusted to police themselves effectively.

CalPrivacy’s crackdown extends beyond registered brokers to unregistered entities, intensifying enforcement actions that include investigative sweeps and settlements with firms such as Key Marketing Advantage, Jerico Pictures, and S&P Global Inc. This regulatory push, coupled with the Delete Act’s annual January 31 registration deadline, highlights the significant compliance burden brokers face, especially as regulators focus on the risks inherent in bulk collection and profiling of sensitive personal data—practices prone to inaccuracies and consumer harm, as noted in related Oregon privacy complaints.

The regulatory emphasis on consumer empowerment is evident in the law’s facilitation of a quick and affordable process for individuals to remove their personal data, reflecting a broader shift toward enhancing consumer control over digital dossiers. However, this consumer-centric approach intensifies operational demands on brokers, who must navigate the dual pressures of rapid compliance and rigorous verification without any grace periods, thereby magnifying the legal and logistical complexities inherent in California’s evolving privacy enforcement regime.

California's implementation of the DROP platform and the Delete Act has fundamentally reshaped data brokers' operational landscape by imposing stringent mandates for processing deletion requests and registering annually. Brokers like VisitIQ and HealthWise Data have struggled under these requirements, denying or ignoring over one million deletion requests combined, which has intensified regulatory scrutiny and exposed them to steep fines of $200 per day per unprocessed request. This regulatory shift, described by CalPrivacy officials as a “major milestone,” signals a new era of accountability underscored by upcoming independent audits starting in 2028, reflecting a broader industry push toward standardized deletion processes and transparency.

The heightened enforcement environment has expanded the definition and scope of what constitutes a data broker, compelling more entities to register and comply with transparency mandates. Settlements with companies such as Key Marketing Advantage, Jerico Pictures, and S&P Global Inc. illustrate the agency’s aggressive stance on registration compliance. Meanwhile, concerns about the bulk collection and profiling practices of brokers—highlighted by the Oregon attorney general’s report noting that nearly 29% of complaints under the Oregon Consumer Privacy Act targeted data brokers—underscore the risks of inaccurate and sensitive personal data handling, further complicating brokers’ operational responsibilities.

The high denial rates of deletion requests by brokers have sparked significant controversy over the legitimacy of their verification processes and the reliability of self-reported compliance data. Privacy advocates and officials caution that brokers cannot be trusted to self-audit, emphasizing the need for external oversight to ensure accurate reporting and adherence to deletion mandates. This tension between regulatory demands and business practices highlights the ongoing challenges data brokers face in balancing operational burdens with stringent consumer privacy protections.

Data brokers compile extensive digital dossiers from everyday activities such as loyalty cards, browsing habits, and social media, creating unauthorized files that fuel scams, phishing attacks, and even physical harm. The Justice Department’s 2024 prosecution of brokers selling vulnerable populations’ data and the massive 2024 National Public Data breach exposing billions of records underscore the severe privacy and security risks consumers face from this opaque, multibillion-dollar industry operating largely out of public view.

The DELETE Act and California’s DROP platform represent a landmark shift in consumer empowerment by enabling residents to submit a single, free request to remove their personal data from over 500 brokers simultaneously. This streamlined, affordable process significantly reduces the burden of manual opt-outs and marks the largest consumer-privacy lever in the U.S. in years, allowing individuals to substantially diminish their data exposure and complicate brokers’ ability to profit from their information.

Despite these advances, full data removal remains elusive due to the sheer scale and complexity of the data broker ecosystem, with thousands of entities trading and re-trading personal information. High denial rates of deletion requests—such as VisitIQ LLC rejecting over 270,000 out of 363,000 requests and HealthWise Data complying with fewer than 10,000 out of 98,000 in 2024—highlight ongoing challenges in broker compliance and the limitations of self-auditing, prompting regulators to impose fines of $200 per day for noncompliance to strengthen enforcement.

California residents now benefit from the state-run DROP platform, a centralized portal launched in August 2026 that allows them to submit a single free deletion request to over 600 registered data brokers. This streamlined process replaces the previously fragmented and manual opt-out efforts, obliging brokers to erase personal data within 90 days and maintain compliance thereafter, making it the most powerful privacy tool currently available to U.S. consumers. By verifying residency and providing basic contact information, Californians receive a DROP ID to track their requests, significantly simplifying data management and reducing their online footprint.

For consumers outside California, managing data broker exposure remains a labor-intensive task requiring individual opt-out requests to each broker, often via web forms or emails, and meticulous record-keeping to track submissions and confirmations. Tools like Google’s 'Results about you' can aid in removing personal information from search results, while opting out of major people-search sites is recommended despite being time-consuming and repetitive due to brokers continually re-adding data from fresh public records. This ongoing maintenance—ideally performed biannually—helps keep personal data less accessible and frustrates those profiting from its sale.

While complete erasure from the internet is impossible, consumers can substantially hinder data brokers and scammers by making themselves harder targets through repeated deletion efforts and strategic data management. Employing multiple email addresses—reserving one for critical accounts and using aliases or disposable emails for less essential services—along with VPNs to mask IP addresses and limiting the sharing of full legal names or exact addresses, reduces brokers’ ability to unify personal profiles. Third-party services like DeleteMe, Optery, Kanary, and Malwarebytes Personal Data Remover offer convenient assistance by automating opt-outs and monitoring ongoing exposure, though they do not guarantee total removal and should be viewed as time-saving complements rather than complete solutions.

While Google reversed its plan to phase out third-party cookies, the digital advertising landscape has irrevocably shifted due to stringent legal and regulatory pressures that prioritize compliance over technological convenience. As noted in the 2026 analysis, 'the cookie survived, but the world that made cookie-based targeting easy did not,' underscoring that evolving laws now impose far stricter constraints than any browser setting ever did. This regulatory tightening is compounded by the proliferation of comprehensive consumer privacy laws across more than twenty states by early 2026—including recent additions like Indiana, Kentucky, Rhode Island, Oklahoma, and Alabama—creating a complex multi-jurisdictional environment that profoundly influences data broker practices and consent frameworks.

Independent of Chrome’s policies, a significant portion of web traffic has already transitioned to a cookieless environment due to proactive browser restrictions, signaling that the industry’s move away from cookie-based targeting is well underway. Browsers like Safari, with its Intelligent Tracking Prevention since 2020, Firefox’s Total Cookie Protection, and Brave’s near-total blocking collectively account for roughly 20% of global traffic arriving without usable third-party cookies. This early shift highlights how technological adaptations and privacy-conscious browser designs have preempted and reinforced regulatory trends, forcing advertisers and data brokers to innovate within a landscape where traditional tracking methods are increasingly untenable.