Quick answer
DROP (the Delete Request and Opt-out Platform) lets California residents send one deletion request to every registered data broker. It does not cover companies you have a direct relationship with, like your streaming services, online stores, or apps. To get your data deleted from those, you still have to ask each company yourself.
What is DROP?
DROP was created under California's Delete Act and is run by the California Privacy Protection Agency, now called CalPrivacy. It opened to the public on January 1, 2026, at privacy.ca.gov/drop.
Instead of contacting hundreds of data brokers one at a time, you verify that you live in California and submit a single request. Since August 1, 2026, registered data brokers have been required to check DROP at least every 45 days and delete matching information. More than 600 data brokers have registered, and hundreds of thousands of Californians have already filed requests.
It's free, and you can also file for someone else in your household, such as a parent filing for a child or a family member filing for an elderly relative.
What counts as a data broker?
Under California law, a data broker is a business that collects and sells personal information about people it has no direct relationship with. You've probably never heard of most of them. They gather information from other companies, apps, and public sources, then sell profiles for marketing, background checks, and people-search websites.
That definition is the key to understanding what DROP can and can't do.
DROP reaches
Registered data brokers: companies that buy and sell information about you without you ever being their customer.
DROP doesn't reach
Companies you did business with: the streaming service you subscribe to, the store you ordered from, the app you signed up for.
What DROP doesn't cover
Companies you've actually done business with
This is the biggest gap. Netflix, Amazon, your meal-kit service, the airline you flew last year, the newsletter you signed up for in 2014: none of them are data brokers, because you have a direct relationship with them. DROP never sends them your request. They keep your name, email, address, purchase history, and more until you ask them to delete it.
That matters because these companies hold some of your most detailed information, and they're the ones that show up in data breach notices.
People who don't live in California
Only California residents can use DROP. A few other states, including Texas, Oregon, and Vermont, require data brokers to register, but as of this writing none of them offer a one-stop deletion tool like DROP.
Data brokers that haven't registered
DROP only reaches brokers on California's registry. A broker that ignores the law and never registers won't see your request, although it can face fines for that.
Some kinds of information
Certain information is handled under separate laws, such as credit reports. And public records like court or property records stay public at the government office that keeps them, even if a broker deletes its copy.
Requests that can't be matched to you
If a broker can't verify that a request is yours, the law requires it to at least stop selling or sharing your information. That's helpful, but it isn't the same as deletion.
DROP and DataTrail side by side
| California DROP | DataTrail | |
|---|---|---|
| Who it reaches | Registered data brokers | Companies you've done business with, found in your inbox |
| Who can use it | California residents | Residents of most US states at launch |
| How requests are sent | One request through the state's platform | A ready-made request for each company, sent from your own email |
Covering the other half
If you live in California, use DROP. It's free, and it handles data brokers better than anything else available. But it leaves out the companies that know you best: the ones with your account, your address, and your order history.
That's the half DataTrail is built for. It scans your inbox (read-only) to find every company that has your email address, flags the ones with known data breaches, and writes a deletion request for each one that cites the privacy law where you live. You review it and send it from your own email, then track whether each company responds on time.
Used together, DROP clears out the companies you never chose, and DataTrail clears out the ones you did.
Find the companies DROP can't reach
DataTrail launches first in the US. Join the waitlist and we'll let you know the day it's ready.
Join the waitlistDataTrail isn't affiliated with the State of California or CalPrivacy. For official details about DROP, visit privacy.ca.gov/drop. This page is general information, not legal advice.