The California Delete Act Explained: One Click to Erase Your Data from Brokers

Imagine being able to press a single button and have your personal data deleted from every data broker in California — hundreds of companies that buy, sell, and trade your name, address, phone number, purchase history, and browsing habits. That's exactly what California's Delete Act (Senate Bill 362) promises.

Signed into law in October 2023, the Delete Act required the California Privacy Protection Agency (CPPA) to build a free, centralized deletion mechanism — a single portal through which California residents can request deletion of their personal information from all registered data brokers simultaneously. The portal, known as the Data Registration and Opt-out Platform (DROP), represents the most ambitious data privacy initiative ever attempted by a US state.

For anyone who has ever tried to remove their information from data broker sites individually — navigating dozens of different opt-out forms, each with different requirements — the Delete Act is transformative.

How the Delete Act Works

The Delete Act operates on a simple but powerful premise: data brokers must register with the CPPA and comply with deletion requests received through the centralized portal. Instead of submitting individual requests to each of the hundreds of data brokers operating in California, you submit one request through DROP.

When you submit a deletion request, the CPPA forwards it to every registered data broker. Those brokers are then legally required to process the deletion within a specified timeframe. The system also allows you to set up recurring deletion requests — acknowledging the reality that data brokers continuously re-acquire personal information from public records, purchase data, and other sources.

The Act also imposed a January 2028 deadline for data brokers to implement processes for honoring automated deletion signals from the portal — meaning the system will eventually work without you even needing to submit individual requests.

Who Qualifies as a Data Broker Under the Act

The Delete Act defines data brokers broadly: any business that knowingly collects and sells the personal information of consumers with whom the business does not have a direct relationship. This captures the traditional 'people search' sites like Spokeo and BeenVerified, as well as data aggregators, advertising data companies, and background check services.

As of 2024, over 500 data brokers had registered with the CPPA. This number is expected to grow as enforcement increases and the definition is applied more rigorously. Companies that fail to register face penalties of up to $200 per day of non-compliance.

Importantly, the Act does not cover companies with which you have a direct consumer relationship — your bank, your cell phone provider, or an online store where you have an account. Those data relationships are governed by other privacy laws like the CCPA/CPRA.

The Broader Data Broker Landscape

The California Delete Act addresses a problem that extends far beyond California. Data brokers operate nationally and internationally, collecting and selling personal information on hundreds of millions of individuals. A 2024 report estimated that the data brokerage industry generates over $200 billion annually.

The personal information sold by data brokers includes: full names and aliases, current and previous addresses, phone numbers, email addresses, family relationships, estimated income and net worth, purchase history, political affiliations, health information (in some cases), and increasingly, location tracking data from mobile devices.

This data fuels targeted advertising, but it also enables stalking, harassment, identity theft, and fraud. Domestic violence survivors, public figures, law enforcement personnel, and anyone who values their privacy has a legitimate interest in removing their information from these databases.

Using the DELETE Portal Effectively

To use the deletion portal, you'll need to verify your identity — the system needs to confirm you are who you claim to be before sending deletion requests on your behalf. This typically involves providing your name, email address, and other identifying information.

Once verified, submit a deletion request for all registered brokers. Set up recurring deletions if the option is available — data brokers will re-acquire your information over time from public records, purchase data, and other sources. A one-time deletion provides temporary relief; recurring deletions provide ongoing protection.

After submitting your request, monitor your exposure. Search for yourself on popular people-search sites to verify that your information has been removed. If specific brokers haven't complied, you can file a complaint with the CPPA, which has enforcement authority including the power to impose fines.

Beyond California: The National Trend

California's Delete Act is a model that other states are watching closely. Several states have introduced or enacted similar legislation targeting data brokers, and there is growing momentum for federal data broker regulation.

Vermont, Oregon, and Texas have all enacted data broker registration requirements, though none yet match California's centralized deletion mechanism. At the federal level, proposed legislation has sought to create a national data broker registry with opt-out capabilities similar to the Delete Act.

For non-California residents, the Delete Act still offers indirect benefits. Many data brokers, rather than maintaining separate systems for California and non-California residents, apply deletion requests broadly. Filing through California-based mechanisms can sometimes result in nationwide data removal — though this is not guaranteed and should not be relied upon as a substitute for exercising rights under your own state's laws.