California's DROP Data Deletion Tool: What LA Startups Should Know

California now has a single button that lets residents tell hundreds of data brokers to erase what they know about them. The state's Delete Request and Opt-out Platform, known as DROP, has been taking consumer requests since January, and since Aug. 1, 2026, registered data brokers have been required to act on them. For most Los Angeles small businesses, DROP is a privacy headline. For ad-tech and martech startups, lead-generation shops and anyone who buys consumer lists, it is starting to change how the data business works.

What DROP is

DROP was created under California's Delete Act and is run by the California Privacy Protection Agency, which now calls itself CalPrivacy. A California resident verifies residency once, creates a profile and submits a single request that goes to every registered data broker. According to the state's DROP page for consumers, one request reaches more than 600 registered brokers.

The scale is already large. At its August board meeting, CalPrivacy reported roughly 450,000 deletion requests covering more than 200 million identifiers, according to a Wilson Sonsini summary of the meeting.

Who counts as a data broker

The law's definition is narrower than many founders assume. Under California law, a data broker is a business that knowingly collects and sells to third parties the personal information of consumers it does not have a direct relationship with. CalPrivacy's information page for data brokers walks through the definition.

That means a typical LA retailer, restaurant or e-commerce brand selling to its own customers is generally not a data broker. A startup that builds audience segments from third-party sources and sells them, a people-search site or a company that compiles and resells contact data probably is. The gray zone is where many young companies live: enrichment tools, lead marketplaces and apps that monetize data from users of other services. If your revenue depends on selling data about people who never signed up with you, assume you need a closer look.

What brokers must do now

The obligations are detailed in CalPrivacy's guide to processing DROP requests:

• Download deletion lists at least every 45 days. Lists contain hashed identifiers in six types, including email, phone number, mobile advertising ID and name plus date of birth plus ZIP code.
• Match and delete. When a record matches, the broker deletes all non-exempt personal information about that person, including inferences, and directs its service providers and contractors to do the same.
• Report back within 45 days on each request's status, such as deleted, opted out, exempted or not found.
• Keep deletions in effect so the same person's data does not reappear when new data comes in.

The cycle tightens next year. Under AB 883, brokers will have to process deletion requests at least every 30 days starting Jan. 1, 2027.

Registration and the cost of getting it wrong

Data brokers must register with CalPrivacy every January. State law, at Civil Code section 1798.99.82, sets the deadline as Jan. 31 following each year a business operated as a broker. CalPrivacy has said the 2027 registration fee will be $9,500, up from $6,000, as reported by Bloomberg Law. Missing registration can bring daily fines plus the unpaid fees.

The penalties for not processing requests are steeper. Wilson Sonsini notes the Delete Act's penalty of $200 per request per day currently has no cure period. For a broker sitting on thousands of unprocessed requests, the math gets serious quickly.

Why non-brokers should still pay attention

Even if your company is not a broker, DROP affects you if you buy from one. Lists and audiences purchased from registered brokers will thin out over time as Californians opt out, and match rates on California consumers may drop. Several practical steps follow:

• Ask vendors how they handle DROP. A reputable data provider should be able to explain its download and deletion cycle.
• Lean on first-party data. Email lists, loyalty programs and customer accounts built with clear consent are not affected by DROP the way purchased data is.
• Recheck your own model. If you are adding a data-sales revenue line, find out whether it makes you a broker before you launch, since new brokers must create a DROP account before they begin operating.
• Watch for more rules. CalPrivacy's board has also started work on rules covering browser opt-out signals such as Global Privacy Control, which could affect how websites handle tracking.

For LA's growing crop of AI, ad-tech and creator-economy startups, California's privacy regulator is no longer just a policy topic. It runs a live system that consumers are actively using.

This article is general information, not legal advice.