A data broker with your name, address, or shopping history on file can be fought. In 2026, California's DROP platform opened to consumers on January 1. Brokers must act on requests starting August 1. If you live elsewhere, your rights are thinner and split by state. Here's what matters and what you can do.
California's DROP: One Request, Every Registered Broker
DROP stands for Delete Request and Opt-out Platform. The California Privacy Protection Agency built it under the Delete Act, which lives at California Civil Code section 1798.99.80 and following. File once through the state, and your request reaches every registered California data broker. You verify California residency through identity verification providers. If they can't confirm you, ask for a residency review under Title 11, section 7622 of the California Code of Regulations. Filing costs nothing. Brokers pay an access fee to download deletion lists through the CPPA data broker portal.
What Brokers Must Do After You File
From August 1, 2026, data brokers must access DROP at least once every 45 calendar days to download consumer deletion requests. They can check more often if they want. Turns out the broker side runs four steps: download the list, standardize and hash records, match and process, then report back. CalPrivacy runs a sandbox tool so brokers can test their matching before going live. The process flow on CalPrivacy's site lays it out. Within 45 days of detecting your request, a broker must process the deletion and report "DELETED" status back to the platform. Ignore a DROP request and civil penalties under California law apply.
Registration and Reporting: What Brokers Owe California
Unregistered brokers never appear in DROP, so the registration calendar matters. A business that operated as a data broker in the prior year must register with CalPrivacy by January 31. Trade names and website addresses all have to be disclosed. A December 2025 enforcement advisory from CalPrivacy called out businesses hiding behind subsidiary names or alternate sites. So if you're checking whether a broker is registered, search the names it does business under, not just the parent company.
By July 1 after a broker's first year, it must publish in its privacy policy how many consumer requests it received, how many it complied with in whole or part, and how many it denied during the prior calendar year. That gives you a way to see whether a broker honors requests before you file one.
Do You Have to Be in California?
For DROP, yes. The platform is for California residents as state regulations define them. If you're elsewhere, you may still have opt-out or deletion rights under your own state's privacy law, but you'll need to contact brokers directly. Over 20 states now have comprehensive privacy laws giving consumers the right to opt out of the sale of personal information, according to the IAPP's state legislation tracker. Colorado, Connecticut, and New Jersey are among the states requiring businesses to honor universal opt-out signals like Global Privacy Control. California has recognized GPC since 2021, longer than any other state. Use a browser that supports GPC and that preference travels with you. It's a signal that says don't sell or share my data.
Vermont's Registry: Visibility Without a Deletion Portal
Vermont has a data broker registry, but it works differently than California's. No central deletion portal exists. You contact each broker on the registry individually. Bill H.211 started as a Delete Act with a universal deletion portal and an explicit consumer right to delete. The Senate stripped those provisions before passage. They were replaced with a feasibility study due December 2028. The enrolled version, Act 138, did not create a consumer deletion right.
What Vermont still offers is a public registry where you can look up registered brokers. A 2026 fiscal note tied to H.211 listed 283 registered brokers, but check the live Vermont Secretary of State registry before acting on that number. Thing is, Vermont's data broker registration sits alongside other privacy protections in Title 9, Chapter 62: breach notification, student privacy, and Social Security number safeguards.
What to Do When a Broker Ignores You
If you've filed a request and the deadline has passed, a few escalation paths open up. For DROP-related failures in California, report the issue to CalPrivacy. For violations under a state privacy law, your state attorney general's office is usually the right place to complain. Many guides also recommend the FTC's Report Fraud portal. The FTC acts on patterns of deception rather than individual complaints, so one complaint rarely moves an agency. Some consumer advocates say roughly 40% of opt-out requests go unanswered. Keep records of when you submitted and what you sent. Screenshots and confirmation emails matter if you escalate.
DIY Opt-Out vs Paid Removal Services
Manual opt-outs take time. Expect 15 to 30 minutes per broker if you're working alone, and dozens of brokers may hold your information. Paid removal services bundle multiple brokers into one request and handle follow-ups. Plans usually run $95 to $180 a year. Consumer Reports found in 2024 that some of the best-known removal services were less effective than doing the work manually. That doesn't make them useless, just that the automatic advantage isn't guaranteed. Go the DIY route and set a calendar reminder to recheck every few months. Brokers re-add data over time. This isn't a one-time checklist.
FAQ
Is DROP free for consumers?
Yes. Brokers pay an access fee to download deletion lists, but consumer submissions cost nothing.
Do I need to live in California to use DROP?
You need to verify California residency through the platform's verification providers. If that doesn't work, you can request a residency review.
How long does a broker have after my DROP request?
The broker must access DROP at least every 45 days, then process and report within 45 days of detecting the request.
What's the penalty for ignoring a deletion request?
In California, DROP-related failures can trigger civil penalties under state law. Other state privacy laws carry their own penalty structures, which vary by state.
Can I use DROP if I'm in Vermont or another state?
No. DROP is California-specific. Other states grant opt-out rights, but you'd contact brokers directly unless your state builds its own portal.
What if the broker never responds?
Report it to the relevant state attorney general, or to CalPrivacy if it involves DROP. Keep your confirmation records.