How to Delete Your Data From Data Brokers for Free
California now forces registered data brokers to act on deletion requests. Here is how to delete your data from data brokers, what it costs, and what it misses.
If you live in California, you can delete your data from hundreds of data brokers with one free request. The state runs a portal called DROP, where you confirm your residency, create a profile, and submit a single deletion request that reaches every registered broker at once. If you live anywhere else, there is no single switch, so the job becomes a list you work through by hand. Either way the useful framing is the same: this is a maintenance habit, not a one time cleanup, because the records refill from the ordinary paperwork of daily life.
The reason to do this now rather than someday is that the deadline just passed. Californians have been able to file deletion requests since January, but the brokers on the receiving end had no obligation attached to them. As of August 1, 2026, that changed. The California Privacy Protection Agency now requires registered data brokers to access the platform at least once every 45 days to retrieve and process the requests waiting there. Requests that sat untouched for seven months are finally on a clock.
What actually changed on August 1
The Delete Act built this mechanism in two stages, which is why the rollout felt so quiet. Under the regulations approved by the agency, the consumer side opened first: the rules took effect on January 1, 2026, and any California resident could file from that month onward. The obligation side opened on August 1. A registered broker must now retrieve requests at least every 45 days, report the status of each request within 45 days of retrieving it, and delete all matching personal information, including the inferences drawn about you, unless a legal exemption applies.
Stack those two windows together and the practical timeline becomes clear. A request that was already sitting in the system on August 1 could reasonably take until late October before every broker has retrieved it, acted, and reported back. So if you filed in January and nothing appeared to happen, nothing was supposed to happen yet. That is worth knowing before you conclude the tool is broken.
The quieter provision matters more than the deletion itself. Brokers are required to keep a record of the deletion requests they receive, specifically so that your information stays deleted going forward rather than reappearing the next time they buy a fresh database. A one time purge would be close to worthless. A standing instruction is not.
How to file the California request
The portal lives at privacy.ca.gov/drop and it is free. The state describes it as three steps, and in practice it is close to that, with a fourth step that most people skip.
- 1
Confirm you are a California resident
The platform verifies state residency before it will accept a request, because the deletion right it enforces is a California right. - 2
Create your profile
You enter the identifying details that brokers will match against their records. This is the part that feels backwards, and it is worth sitting with for a second: to be found and erased, you first have to say exactly who you are. - 3
Submit the request
One submission reaches every broker on the state registry at once, rather than you filling in a separate form on each company website in turn. - 4
Go back and check the status
Brokers report back through the same platform. Since the reporting window runs 45 days past retrieval, the useful move is a calendar check in about three months, not a refresh tomorrow.
Include the identities you have moved on from
What to do if you do not live in California
There is no national equivalent, so the honest answer is that this takes an evening rather than five minutes. The good news is that California accidentally did the hardest part of the work for everyone, which is producing a public, maintained list of who these companies actually are.
- Start from the state registry rather than a blog list. Because brokers operating in California must register, that registry is the closest thing to a real index of the industry, and it is public for anyone to read.
- Work through the opt out pages one broker at a time. Many companies run a single opt out process for everyone instead of maintaining a separate California path, since one process is cheaper than two. That is operational convenience rather than a legal guarantee, and it can change without notice.
- Check what your own state gives you. A growing number of states now have comprehensive privacy laws in force, several carrying deletion and opt out rights, and some specifically restricting the sale of sensitive categories such as precise location.
- Treat paid removal services as a time trade, not a capability you lack. They file the same requests you can file yourself, on a recurring schedule. If you would genuinely never do the follow up, paying for the follow up is a reasonable trade. Just know what you are buying.
What a deletion request does not cover
This is where most people are quietly disappointed, so it is better to set the expectation before you file rather than after.
| What people expect | What actually happens |
|---|---|
| My name disappears from search results | Search is a separate system. Deletion reaches records held by brokers, not news articles, court records, or pages on sites where you opened an account yourself. |
| Every company holding my data has to erase it | The obligation runs to registered data brokers. A company you handed your data to directly is not a broker, and a broker that never registered is an enforcement problem rather than a completed deletion. |
| Absolutely everything gets erased | Deletion applies unless a legal exemption covers the record. Brokers also retain a record of the request itself, which is the mechanism that keeps the deletion in force later. |
| One request and I am done forever | It holds against the data they have today. New records about you keep entering the pipeline through ordinary transactions. |
Deletion is not the same as anonymity
Why the records come back
Brokers do not mostly collect data by watching you. They buy and aggregate it, which means the refill happens through paperwork you generate yourself, usually without noticing. The common sources are boring, and that is exactly why they work.
- Public filings. Property transactions, business registrations, licenses, and court records enter the public domain by design, and aggregation is the entire business model.
- Loyalty programs, warranty cards, and sweepstakes entries, where handing over an address and a birthday is the actual price of admission.
- Quizzes, free tools, and giveaways that are pleasant on the surface and are collection mechanisms underneath.
- App permissions, particularly location, where the data ends up passed to partners you never had a relationship with.
- Moving, marrying, changing your name, or opening a new account, each of which mints a fresh identity record tied back to the old one.
The same logic applies to the software you use every day, which is a separate question from brokers but sits next to it. It is worth knowing what to ask before handing an assistant your personal information, and worth deciding deliberately whether an assistant should be allowed to read your messages. Those choices decide what exists in the first place, which is upstream of any deletion request. Regulation is moving in the same direction: the transparency rules arriving under the EU AI Act are built on the same premise, that you cannot exercise a right you were never told you had.
Make it a recurring check instead of a one time cleanup
Almost everyone who files one of these requests intends to check back. Almost nobody does, because the follow up lands three months out, has no external deadline, and nobody is waiting on it. This is the standard failure pattern for life admin: the task is not hard, it is just easy to never think about again.
The fix is unremarkable. Put the follow up somewhere that will raise its hand later, on the same day you file. Say it out loud into Tase and it becomes a dated reminder, and if you set it to repeat, the annual version arrives without you having to remember that any of this ever happened. A privacy routine that survives is worth considerably more than a thorough one you do once and abandon.
How long does a data broker deletion request take?+
Brokers must retrieve pending requests at least every 45 days and report the status of each one within 45 days of retrieving it. Stacking those windows, expect up to roughly three months for the full cycle rather than same day removal.
Do I have to be a California resident to use DROP?+
Yes. The platform verifies state residency because it enforces a California right. If you live elsewhere you can still use the public broker registry as a target list and file opt out requests with each company directly, plus whatever rights your own state law gives you.
Does deleting my data from brokers remove me from Google?+
No. Search results index pages published elsewhere, so removing broker records does not remove news coverage, court records, or accounts you created yourself. Those are separate requests to separate parties.
Is it free, and are paid removal services worth it?+
The California platform is free. Paid services file broadly similar requests on a recurring schedule, so what you are buying is the follow up rather than access you could not otherwise get. That can be a fair trade if you know you would never do the follow up yourself.
Will I have to do this again?+
Plan on it. Brokers must keep honoring an existing request rather than re-adding the same records, but new information about you keeps entering the system through public filings, purchases, and new accounts. An annual check is a reasonable rhythm.
Do not lose the follow up
File the request today, then say the three month check into Tase so it comes back on its own. The privacy tasks that work are the ones you do not have to remember.
Try it freeRelated guides