Data Broker Opt Out: Key Takeaways
- California’s DROP tool enables a single data broker opt out request covering 543+ registered brokers with legally required 90-day deletion and 45-day recurring cycles.
- The data broker opt out process through DROP only applies to California residents and state-registered brokers, leaving gaps for noncompliant or unregistered companies.
- For everyone else, a manual data broker opt out targeting high-exposure sites first can yield faster initial results than some paid services.
- Paid removal services provide ongoing monitoring and resubmission across dozens of brokers, reducing the burden of tracking multiple data broker opt out relationships over time.
Data brokers, companies that collect and sell personal information, names, addresses, phone numbers, browsing habits, purchase history, to advertisers, background-check services, and anyone else willing to pay, have historically made opting out a genuinely tedious, one-broker-at-a-time process. In 2026, that changed meaningfully for one group of people, and stayed exactly the same tedious process for everyone else.
Table of Contents
California’s New Free Tool, Explained
The Delete Request and Opt-out Platform, run by the California Privacy Protection Agency and known as DROP, launched at the start of 2026 and lets California residents request deletion of their personal data from at least 543 registered data brokers in a single submission, at no cost. Using it requires verifying California residency through the state’s identity verification gateway, then submitting standard identifying information: name, address, email, phone number, date of birth, and optionally a mobile advertising ID for more thorough matching against broker records.
Starting August 1, 2026, registered data brokers are legally required to complete the deletion within 90 days of a DROP request, and the deletion isn’t a one-time event: brokers must repeat the deletion process every 45 days going forward, specifically to catch new data these companies continue collecting on an ongoing basis rather than treating the original request as a permanent, one-time fix.
Why the Repeating Requirement Matters
That 45-day repeat cycle is a genuinely important design detail, not a bureaucratic technicality. Data brokers don’t just hold onto old records; they continuously acquire new data through purchases, public records scraping, and other means, meaning a single deletion request would otherwise become stale within weeks as fresh data flows back in.
Building the deletion obligation to recur automatically, rather than requiring a resident to resubmit a fresh request periodically, is what makes DROP a genuinely durable solution rather than a one-time cleanup with fast-expiring value.
What This Doesn’t Cover
It’s worth being precise about the real limits of this tool before assuming it solves the data broker problem completely. DROP only reaches data brokers registered with the state of California, meaning any broker operating without registering, whether through noncompliance or by not meeting the technical definition of a covered data broker, falls outside its reach entirely.
It’s also geographically scoped to California residents specifically; someone living in any other state can’t use DROP to request deletion of their own information, since the tool verifies California residency as a prerequisite.
Other States Are Building Similar Frameworks, Just Without a Free Tool Yet
California isn’t alone in regulating data brokers, even if it’s currently the only state offering a single free deletion tool. As of 2026, five states, California, Vermont, Texas, Oregon, and Connecticut, require or have enacted data broker registration obligations. Vermont was actually first, requiring registration since 2019, and amended its law in mid-2026 to add breach notification requirements and annual registration obligations taking effect January 1, 2027.
Texas established registration requirements through a 2023 law, Oregon did the same starting January 2024, and Connecticut became the fifth state to pass a registration law, with its requirement also taking effect January 1, 2027.
None of these other four states currently offer a DROP-equivalent single deletion tool the way California does; their laws primarily require brokers to register and disclose their existence publicly, a meaningfully smaller consumer-facing benefit than California’s actual bulk-deletion mechanism, though registration itself is a real prerequisite step that could support a similar deletion tool being built later in any of these states.
What Everyone Outside California Still Has to Do
For the large majority of the country without an equivalent state-run tool, the choice comes down to a manual DIY process or a paid removal service. The DIY approach costs nothing but real time: submitting requests individually to as many as 50 or more separate data broker sites, then following up periodically since some brokers don’t process requests promptly or at all on the first attempt.
Notably, testing has found the manual approach can actually outperform paid services in the short term, yielding faster initial removal results in some comparisons, likely because a motivated individual submitting requests directly avoids some of the delays and incomplete coverage that automated bulk-service tools run into.
Where Paid Services Fit In
Paid data-removal services, DeleteMe, Privacy Bee, Kanary, and Optery among the more established options, typically run $100 to $200 a year and handle the submission and follow-up process across dozens to hundreds of broker sites on an ongoing basis, rather than a single one-time cleanup. Independent testing found Optery and EasyOptOuts as standout performers, each successfully removing more than 65% of found profiles, a meaningfully high success rate but still short of complete coverage.
The real value proposition of a paid service isn’t necessarily faster or more thorough removal than a determined DIY effort, based on the testing above, but ongoing monitoring and resubmission without requiring the user to manually track dozens of separate broker relationships over time.
Why This Is Worth the Effort, Not Just a Privacy Preference
It’s worth being direct about why data broker removal matters beyond a general sense that companies shouldn’t be selling personal information. Documented harms tied to broker and people-search-site data include stalking and domestic abuse cases where a survivor’s home address, published by a people-search site with no screening of who requests it, led to a documented attack, and cases of politically motivated violence against public servants located through the same kind of freely searchable data.
On a more everyday level, scammers use broker-sourced information, names, addresses, phone numbers, relatives, and workplaces, to make phishing attempts, fake IRS calls, and family-emergency scams meaningfully more convincing than a generic cold-call attempt, since the caller can reference real, specific details that make the scam sound legitimate. Well-known people-search sites like Whitepages, Spokeo, and InfoTracer are common sources for this kind of exposure, and none of them typically screen who’s requesting the information they display.
That range of real consequences, from targeted scams up to documented violence, is the actual case for treating data broker opt-out as a genuine safety measure worth the time investment, not just a nice-to-have privacy preference.
A Practical Approach for 2026
A few concrete steps worth following depending on your situation:
- California residents should register with DROP first, since it’s free, covers hundreds of brokers in one submission, and legally requires the 90-day deletion plus 45-day recurring cycle described above, making it the clear starting point before considering any other option.
- Everyone else should start with the highest-exposure brokers manually, prioritizing the sites most likely to surface in a basic search of your own name, rather than attempting all 50-plus broker sites at once, which tends to stall out from sheer volume.
- Consider a paid service specifically for ongoing maintenance, not necessarily faster initial results, if the time cost of tracking dozens of individual broker relationships over months and years outweighs the $100-to-$200 annual cost.
- Re-check periodically regardless of which approach is used, since data brokers, especially those not covered by any automatic recurring deletion requirement, continue acquiring new data on an ongoing basis, meaning a one-time cleanup effort degrades in effectiveness over time no matter how thorough it was initially.
Sources: California Privacy Protection Agency’s own DROP documentation, cross-checked against Privacy Rights Clearinghouse’s and StateOfSurveillance.org’s 2026 reporting.
Bottom Line
California residents should use DROP for a free, legally backed data broker opt out covering hundreds of brokers with recurring deletions. Others should start by manually removing their information from the highest-exposure people-search sites before considering a paid service for ongoing maintenance.
Related Reading
- Texas Sued Five TV Makers Over Spying Smart TVs. Two Settled. Here’s What Changed, and How to Fix Yours Regardless.
- Right to Repair Is Finally Law in Six States and the EU. Here’s What It Actually Guarantees.
- A VPN Provider Was Hacked, Exposing 865,000 Users Who Thought Nothing Was Being Logged. Here’s What VPNs Actually Do.
Further reading: FTC: how websites and apps collect and use your information, Information broker (Wikipedia).
Photo credit: “data privacy” by stockcatalog, licensed CC BY 2.0 (https://creativecommons.org/licenses/by/2.0/). Source: https://www.flickr.com/photos/151691693@N02/40381366025
