California counted 581 data brokers. Here is how to read the registry.

On 2 June 2026 the California Privacy Protection Agency published a number that people-search marketing almost never uses: 581 registered data brokers, the highest count since the registry began in 2020. In the same press release, CalPrivacy said more than 300,000 California residents had signed up for DROP, the state's free deletion platform, in about five months.

Those two figures describe a market, not a cleanup. A registry is an inventory of businesses that collect personal information you did not give them and sell it to someone else. DROP is one request aimed at the brokers who are required to register. Neither number means your information is gone.

This post is how to read the official dataset. The California rights guide is the request workflow. The opt-out directory is the brand-by-brand layer. We are not measuring how long any broker takes to delete a record. That study is not running.

The finding, dated

| Official figure | As of | Source | | --- | --- | --- | | 581 registered data brokers | 2 June 2026 | CalPrivacy press release | | Highest registrant count since the registry was established | 2020–2026 | Same release | | 300,000+ DROP signups | 2 June 2026, about five months after launch | Same release | | DROP opened for consumer requests | 1 January 2026 | Data Broker Registry | | Brokers required to begin processing | 1 August 2026 | Registry page and How DROP works | | Processing interval | At least every 45 days | How DROP works | | Time to report a result | Up to 90 days | How DROP works | | Registry page last updated | 29 July 2026 | Data Broker Registry | | California population estimate | 39,355,309 (1 July 2025) | Census QuickFacts |

Three hundred thousand signups against a July 2025 Census estimate of 39,355,309 residents is about 0.76 percent of the state, five months after DROP opened. That is a real adoption number. It is also a reminder that more than 99 percent of California residents had not used the tool by the date CalPrivacy announced the milestone.

Official DROP milestones

1. 1 Jan 2026

   DROP opens

   California residents can submit

2. 2 Jun 2026

   581 brokers

   300,000+ signups announced

3. 1 Aug 2026

   Processing starts

   45-day cycle, 90-day report

We are writing this on 15 August 2026, fourteen days after processing began. Under the published schedule, a broker that last ran its batch on 1 August need not run another until mid-September, and it may take until late October to report how it handled a request. A “pending” status in August is not evidence that DROP failed. It is evidence that the statutory clock is longer than a news cycle.

What the registry is

CalPrivacy's definition is the one that matters. A data broker is a business that collects personal information about consumers from various sources and sells that information to other companies, even when the consumer did not interact with the business for its products or services. The information can include Social Security numbers, precise geolocation, health-related information, and browsing history.

Registration is annual. Businesses that meet the definition must register between 1 January and 31 January and report on the previous calendar year. The 2026 registry, CalPrivacy says, lists businesses that operated as data brokers in 2025. The agency publishes what they submitted after the registration window closes.

That last sentence is easy to skip and expensive to misunderstand. The registry is a disclosure file. It is not a finding that every listed company broke a law, and it is not a finding that an unlisted company holds nothing about you. A people-search brand can sit behind a parent that registered. A first-party company you actually have an account with is a different legal object. Public-record holders — courts, assessors, licensing boards — are not data brokers because you used DROP.

The live page includes filters the agency actually ships: whether a broker says it collects minors' data, account logins, government IDs or Social Security numbers, citizenship, union membership, sexual orientation, gender identity, biometric data, precise geolocation, or reproductive-health information; and whether it says it sells or shares to a foreign actor, the federal government, state governments, law enforcement, or a generative-AI developer. Those filters are the registrant's answers, not an audit.

CalPrivacy also tells you to download the complete registration file rather than trust the on-page preview. That is the right way to use a government dataset. The interactive table is a view. The CSV is the record.

What 581 does not mean

It does not mean there are 581 independent people-search websites you must visit. Several consumer brands can share a parent, a suppression portal, or a data supply. The opt-out directory exists because PeopleConnect, for example, describes a group suppression that covers named brands and still excludes some search types and other people's reports.

It does not mean DROP will delete 581 copies of your life. CalPrivacy is explicit about what will not be deleted: data you gave a business directly, exempted data, and publicly available data. A property record, a court docket, or a professional licence that is public stays public. A people-search site that reprints it can be told to stop selling a matched profile. The assessor is not in the DROP queue.

It does not mean the count is frozen. The press release's 581 is the last official published total we can cite without executing the live table. The registry page was last updated on 29 July 2026. Client-side tables can render as empty when a crawler cannot run the dataset. If you need the current inventory, open the registry and use the official download. Do not treat a scraped “0 data brokers registered” as a finding.

It does not mean every broker has processed your January request. Processing started on 1 August 2026. The 45-day cycle and the 90-day reporting window are the rules as of the How DROP works page we checked for this post. The first full reporting cycle for a request submitted on day one of processing can extend into autumn.

How to read a row

A useful reading of one registrant is a set of questions, not a vibe.

What do they say they collect? The filter columns are the agency's grouping of the CSV. “IDs / SSN” and “precise geolocation” are different harms. A broker that claims neither can still hold a name, a phone number, and a previous address — the usual people-search payload.

Who do they say they sell or share to? A row that includes law enforcement or a foreign actor is a disclosure, not a verdict. It tells you the registrant's claimed downstream. It does not tell you whether your record was in a particular sale.

Are they a consumer people-search brand, a B2B data supplier, or both? The registry mixes companies a person would search for themselves with companies that sell files to other companies. DROP is aimed at the registered-broker layer. A suppression form on a consumer site is a product change at that site.

Is this the parent or the brand? If you found a listing on a familiar people-search domain, do not assume the domain name is the registered legal entity. Read the row, then read that company's current privacy or suppression page. The directory we maintain is a starting map of official routes, not a substitute for the registry CSV.

What would “deleted” mean for this row? Under How DROP works, “Deleted” means the broker deleted matched covered data and will no longer sell it, while legally exempt information may remain. “Exempted” means the broker says everything it kept is exempt. “Opted-out” means it could not make an exact match and must stop selling information associated with the identifiers you provided, as DROP describes that status. “Record not found” is not proof the broker never held data. “Pending” is the clock.

If you want a specific broker to keep selling your information, DROP lets you uncheck that broker. That is a choice with a plain consequence: those companies continue to sell.

How to read 300,000 signups

CalPrivacy presents the signup count as evidence that residents want a working deletion tool. That reading is fair. A free official mechanism that reaches the registered-broker layer is a different object from a paid opt-out service or a weekend of manual forms.

The same count is also a coverage number. Against 39.4 million residents it is small. Against the set of people who will actually search for you, it may be large enough to matter. The people who use DROP are not a random sample. They are the people who heard about the tool, could verify residency, and were willing to give the state a name, a date of birth, and a ZIP code so that hundreds of brokers could try to match them.

Matching is the hidden variable. How DROP works says name, date of birth, and ZIP code are enough to submit, and that more identifiers — emails, phones, former names, mobile advertising IDs, connected-TV IDs, VINs — make a match more likely. A thin profile produces more “opted-out” and “record not found” rows. A thick profile produces more matches and discloses more about you to the matching process. That trade is the consumer's. It is not a reason to paste every identifier you have ever used into a form you do not understand.

We are not going to invent a success rate. CalPrivacy has not published, in the documents cited here, the share of June signups that later came back as Deleted. Anyone who quotes a statewide deletion percentage in August 2026 without a new official release is guessing.

What DROP will not do, even at 581

The official exclusions are the ones that surprise people after they receive a “Deleted” status.

First-party data stays with the company you gave it to. A retailer, a bank, a social network, or a utility is not cleaned up because a broker was. Use that business's own privacy channel, as the California rights guide describes.

Publicly available data can remain. A people-search reprint may fall in scope. The court record it was copied from usually does not. If the harm is the docket, the assessor file, or the professional licence, the record-holder route is the one that exists — and often the one that does not include deletion.

Search engines are a different layer. Google can hide a URL from results under Results about you when the request meets its policy. It will not remove a government, educational, or newspaper page because you asked, and it will not instruct a broker to delete a database row. The four-layer note is the model. The search-result guide is the workflow.

Other people's reports can still name you. The FTC's people-search article warns that opting out of your own listing may leave your details in a relative's or associate's report. DROP does not make you that relative.

Methodology

• Counts we cite: 581 registered brokers and 300,000+ DROP signups, both from CalPrivacy's 2 June 2026 newsroom post. We did not re-count the live JavaScript table.
• Schedule we cite: 1 January 2026 consumer opening and 1 August 2026 processing start from the registry page; 45-day processing and 90-day reporting from How DROP works; page last updated 29 July 2026 from the registry header.
• Population denominator: Census Bureau QuickFacts for California, population estimate 39,355,309 for 1 July 2025. The signup share, 0.76 percent, is 300,000 divided by that estimate. CalPrivacy said “more than 300,000,” so the percentage is a floor against a slightly larger numerator and should be read as “about 0.8 percent,” not as a precise official rate.
• What we did not do: download and analyze the 2026 CSV for this post; contact brokers; measure deletion times; or treat DeepSearch as a registered-broker case study. If we later publish a structured reading of the CSV — categories collected, claimed buyers, parent groups — that work will say so and will date the file.

Previous registry years are downloadable from the same page, including the 2020–2023 files administered by the Department of Justice. A time series of registrant counts would be a useful official chart. CalPrivacy's June release gives us the 2026 peak and the 2020 start. It does not, in that document, publish the intervening yearly totals as a table we can reprint without opening those files.

What to do with this

If you are a California resident and you want the registered-broker layer reduced, use DROP. Save the DROP ID. Read each status. Add identifiers only when a “record not found” or “opted-out” row makes a match failure the likely cause. Do not expect a finished internet on 2 August, or on 15 August.

If you found a specific listing, use the official suppression or privacy route for that brand as well. DROP and a site-level opt-out are not duplicates. One is a statutory request to registered brokers. The other is a product change at a URL you can still see.

If you are trying to understand the market rather than clean a listing, download the registry CSV. Filter it yourself. The 581 figure is a headline. The file is the work.