California PII data brokers must begin processing deletion requests
Under California's Delete Act, registered data brokers need to begin honoring consumer deletion requests submitted through the state's Delete Request and Opt-Out Platform (DROP) according to the California Privacy Protection Agency. A single verified request through DROP directs every registered broker that holds a person's personal information and that broker's service providers to delete it. The agency said brokers must access the platform at least once every 45 days and process requests, subject to limited legal exceptions. Californians have been able to file requests since January 2026.
ASSESSMENT
Data brokers assemble and sell personal and address information drawn from public records, apps, and other sources. Data broker removal is an important part of overall privacy program for families and companies. However, data broker removal is not a silver bullet. There is personally identifiable data that cannot be removed through any means including legitimate publicly available government databases and data posted maliciously on places on the internet like the dark web.
California's DROP platform is one of the first state systems that lets a resident send a single deletion request to many registered brokers at once, though it reaches only brokers registered with the state, is subject to statutory exceptions, and does not cover information a broker collected directly from a consumer. Aggregated broker data can be used to surface a person's home address, daily patterns, and be leverage for fraud or physical attacks.
TAKEAWAYS
The records on these sites can repopulate so families should periodically re-evaluate available deletion and opt-out options across data brokers.
Even if "opt-out" and deletion requests are made, personally identifiable data (PII) can still remain accessible as criminals and hostile intelligence services can purchase data from data brokers before a take down request, obtain the PII and personal health information illegally, access legitimate public sources of data. Moreover, PII can be shared and persist on the dark web.
Lowering your PII data footprint is an important input to cyber, privacy, and physical security planning.
