- Tension: California has built the first deletion mechanism that treats data removal as a standing obligation rather than a single transaction, and the only rigorous field test of manual removal suggests roughly a third of what researchers found stayed put.
- Noise: Coverage has treated August 1 as a launch date, when consumer requests opened seven months earlier — what changed this month is that brokers became legally obliged to act on requests already filed.
- Direct Message: The mechanism’s ceiling is the registry, not the technology, and every enforcement action California has brought so far has been against companies that never registered at all.
To learn more about our editorial approach, explore The Direct Message methodology.
Since August 1, a data broker registered in California has been required to open a state-run file at least once every 45 days, read the list of residents who have asked to be forgotten, and delete them — then come back a month and a half later and do it again. Not once. Every cycle, indefinitely.
What DROP is and when it actually started
The Delete Request and Opt-out Platform was created by the DELETE Act, signed in 2023, and built by the California Privacy Protection Agency. Consumer requests opened on January 1 of this year; the governor’s office reported more than 155,000 Californians had filed one within three weeks. The obligation on brokers is what arrived this month, under a schedule written into Civil Code section 1798.99.86.
A resident files once. The platform verifies California residency, hashes the identifiers — name, address, email, phone, date of birth, optionally a mobile advertising ID — so brokers receive cryptographic fingerprints rather than a fresh dossier, and exposes the list to every registered broker. Requesters can exclude specific companies from their request and amend it after 45 days. The agency’s registry listed 603 registered brokers when it was last updated on July 29; the Electronic Frontier Foundation cited 614 earlier in the month. The number moves as registrations are added and lapse.
The provision that answers the usual objection
The standing complaint about data deletion is that it accomplishes nothing, because brokers re-acquire the same records from the same upstream sources within weeks. California wrote around that. The statute requires brokers to process the deletion list on a recurring 45-day cycle, and separately bars them from selling or sharing newly acquired personal information about anyone on it. The request functions less like an erasure and more like a permanent exclusion.
The penalty structure is the other unusual feature: $200 per deletion request, per day, for non-compliance. Against a list already carrying six figures of requests, a broker that decides to ignore DROP faces theoretical daily exposure with no real precedent in American privacy law.
What the removal research actually found
The most cited independent test of removal is a Consumer Reports study conducted with Tall Poppy and published in August 2024. Thirty-two volunteers were tracked across thirteen people-search sites, where researchers located 379 profile instances, then measured what seven paid removal services and manual opt-out managed to clear at one week, one month and four months.
Manual opt-out performed best and still left a substantial residue: about 70 percent of profiles gone within a week, 74 percent at one month, and no improvement after that. The paid services ranged from 68 percent for Optery down to 6 percent for ReputationDefender and 4 percent for Confidently — two services that charged money and performed worse than a determined afternoon with a browser.
Two caveats belong on that finding. It is a 32-person field study covering thirteen sites, not a peer-reviewed trial, and it is the best-known test rather than a definitive one. And it measured people-search sites and commercial removal services, which is a different population from California’s registered brokers. The 70 percent figure describes what removal efforts achieved in 2023, not a forecast of what DROP will achieve.
The distinction matters for what a resident should expect. A deletion request is not a guarantee of disappearance from the open web; it is an instruction to a defined set of companies, enforceable against them and inert against everyone else. California is the first state to make that instruction recurring and centrally administered, which is a meaningful change in kind, and it does not alter the arithmetic of who is covered.
The registry is the ceiling
DROP reaches registered brokers. A company that never registers is invisible to it, and that is precisely where California’s enforcement has concentrated. The agency’s Data Broker Enforcement Strike Force announced actions in January against Rickenbacher Data LLC, trading as Datamasters, for $45,000, and against S&P Global for $62,600 — both for failure to register, not failure to delete. The agency says it has brought more than ten such actions.
Other limits are structural. As the EFF has set out in its guidance, vehicle and real-estate ownership records remain public and outside the mechanism’s reach, and organisations that collect data directly from users rather than brokering it — search engines, social platforms, retailers — are untouched. Brokers may also refuse requests under statutory exemptions covering credit reporting, financial services and health-adjacent categories.
The study’s sharpest result is not the headline number but the shape of the curve behind it. Manual opt-out reached roughly 70 percent within the first week and then stopped improving — the remaining profiles were not slow to clear, they were resistant to clearing. Several paid services never reached that first-week figure over four months of trying. For anyone weighing a subscription against an afternoon of form-filling, the study found the afternoon won, and found that neither approach finished the job.
The dataset nobody has read yet
Those refusals come with a paperwork requirement that has gone almost unremarked: brokers must report denials, and denial counts, to the agency. By late this year California will hold a public record of which companies are refusing deletion requests, under which exemption, and how often. Independent third-party audits of broker compliance begin on January 1, 2028, and repeat every three years.
That is a different kind of instrument from the deletion tool itself. A resident filing a DROP request gets a partial, contested, ongoing removal from a subset of the industry, and the Consumer Reports numbers are a reasonable prior on how partial. The state gets something the private removal market never produced — a compliance ledger, in public, naming which brokers process deletions and which invoke an exemption to avoid it. The first tool is what 155,000 Californians signed up for. The second is the one that will determine whether the first was worth building.
