After three years, lawmakers passed Senate Bill 362, “Delete Act,” which takes effect this year. It stops data brokers from selling personal data. Data brokers are companies that collect, analyze, trade, and sell personal information — often without a person’s knowledge or consent. In a statement, Newsom said the Delete Act lets Californians tell data brokers that personal information is not for sale.
“Your data should belong to you, and DROP will make that happen in one simple step,” the governor said.
While the bill was passed in 2023, it took the collective effort of the California Privacy Protection Agency (CalPrivacy) and the California Department of Technology to develop DROP — the Delete Request and Opt-out Platform.
“DROP is a game changer for consumer privacy,” CalPrivacy Executive Director Tom Kemp said in the release. “It’s the first platform of its kind, and it makes exercising privacy rights simple, free, and accessible for millions of Californians. It gives people a straightforward way to take control of their personal information.”
With DROP, Californians can submit a deletion request to more than 500 registered data brokers, Gov. Gavin Newsom’s office said in a news release. Already, more than 155,000 people have used the new program.
“Removing your personal information from the businesses that sell it could decrease the risk of identity theft, fraud, spam calls, and hacking attempts,” said Kemp. “DROP puts that power back in consumers’ hands and helps ensure communities across the state understand and can exercise their privacy rights.”
Starting Aug 1, data brokers are required to delete your personal information upon request — including what’s gleaned from your web searches or the apps you use.
They also have to report the outcome of each DROP request to the California Privacy Protection Agency.
If data brokers fail to comply with a DROP request, they face a daily fine.
To confirm that data brokers are complying with the Delete Act, the Privacy Protection Agency will conduct independent audits starting Jan. 1, 2028, and every three years thereafter.
State Sen. Josh Becker, D-Menlo Park, wrote the Delete Act and said DROP helps California set a national consumer privacy standard.
“I wrote this bill to give people real control over their personal information and protect them from scams, identity theft, and spam emails,” he said in the release. “I’m grateful to see that it’s being called the toughest privacy protection law in the country.”
As of Jan. 1, you can now submit your DROP request by following three steps on the California Privacy Protection Agency website:
Confirm your identity as a California resident through the state’s digital identification service.
Create a profile by providing basic information such as your full name, phone number, and email.
Fill out your DROP request.