California privacy rights: deletion, opt-outs and DROP

Use California privacy rights and DROP accurately: choose a request, verify with minimal data, track deadlines, and understand exemptions.

Lena OrtizUpdated 23 October 20269 min read

Quick answer

A California resident can ask a covered business to know, delete, or correct covered personal information. They can opt out of covered sale or sharing and limit certain sensitive-data use. Submit the specific request through the business's official privacy route. Provide only information needed for verification, and track the response. Use the free DROP system separately.

It sends one deletion and sale opt-out request to active data brokers registered with CalPrivacy. Inspect each broker's status and exceptions.

California's know, delete, correct, opt-out, limit, and equal-treatment rights are distinct remedies – not one universal deletion command.
CalPrivacy says covered businesses should respond within 45 days, while DROP brokers may take up to 90 days to report processing.
DROP can return deleted, exempted, opted-out, record-not-found, or pending; none should be interpreted beyond its defined scope.

Topics: California privacy rights · CCPA · California DROP · Data-broker deletion

California residents have distinct rights under the California Consumer Privacy Act. They also have a statewide deletion mechanism for registered data brokers. Choose the right request: know, delete, correct, opt out, or limit. Send it through the business's official privacy channel and save the response. Use DROP separately for registered data brokers.

This guide reflects official CalPrivacy guidance checked on 23 October 2026. It provides general information, not legal advice. The rules do not cover every business, record or person.

Australian context: California's CCPA and DROP system apply only to California residents and covered businesses under California law. Australian residents have separate rights under the Privacy Act 1988 and Australian Privacy Principles. These include access to, and correction of, personal information held by organisations and agencies.

This guide explains the California framework for educational purposes. It also helps Australians understand requests from California-based services they may use.

The California rights are not one delete button

CalPrivacy summarises the core CCPA rights as LOCKED:

Right	What it addresses
Limit	Limit covered use and disclosure of sensitive personal information
Opt out	Stop covered sale or sharing for cross-context behavioural advertising
Correct	Correct inaccurate personal information a covered business holds
Know	Learn what personal information is collected, used, and shared
Equal treatment	Exercise rights without unlawful discrimination
Delete	Ask a covered business to delete covered personal information, subject to exceptions

Choose the remedy that matches the problem. If a company has the wrong address, a correction request may preserve a necessary account while fixing the risk. If you want it to stop selling covered data, an opt-out is not the same as closing the account. If you need to understand what exists first, begin with a know request.

Check the business and data in scope

The CCPA applies to covered businesses, not every person, nonprofit, government office, or record. Other state and federal laws can govern financial, health, credit, employment, education, communications, and public-sector information. Public records and other categories can also be exempt from a particular deletion mechanism.

Use the business's current privacy notice and CalPrivacy's guidance to determine which route it offers. For a difficult case, contested exception, or safety issue, consult a qualified California lawyer or an appropriate advocate.

For Australian residents: Check the privacy policy of any California-based service you use. It may extend CCPA rights to international users or offer a separate request process. Australian organisations and agencies covered by the Privacy Act must respond to access and correction requests. They must do so within a reasonable period, generally 30 days.

Requesting access is free. Organisations may charge a non-excessive fee for providing access. Agencies cannot charge. Correction requests are free.

Submit a request to a covered business

CalPrivacy's current consumer workflow is:

Find the official privacy channel. Look for Privacy Policy, Do Not Sell or Share My Personal Information, Your California Privacy Choices, or similar language on the business's site.
Select the right. State whether you want to know, delete, correct, opt out, or limit covered processing. A single message can be ambiguous; name each requested action.
Provide only necessary matching information. A business may need to verify identity. CalPrivacy says you only need to provide what the business needs to complete the request. You can use its complaint route if the business demands too much information.
Save the evidence. Record the request URL, date, confirmation, case number, scope, and information you supplied.
Track the response. CalPrivacy says businesses should respond within 45 days and may contact you if they need additional time.

You normally need a separate request for each business. For example, asking a retailer to delete your data does not notify an unrelated broker. That broker may have obtained the same data elsewhere.

If the business ignores the request or you believe it did not follow the law, use the California Privacy Protection Agency's official complaint route. A complaint is stronger when it includes the exact request, confirmation, dates, response, and unresolved issue.

Australian privacy complaints: You must first complain directly to the entity, whether it is an Australian organisation or agency. If it does not respond within 30 days, you may complain to the Office of the Australian Information Commissioner (OAIC). You may also complain if its response is unsatisfactory.

Some complaints may need to go to an approved external dispute resolution scheme before the OAIC. These include electricity, gas and water providers in ACT, NSW, QLD, SA, VIC and WA. They also include financial service providers and Victorian public transport.

Use DROP for registered data brokers

The Delete Request and Opt-out Platform, or DROP, is a separate, free service for California residents. It sends one request to active data brokers registered with CalPrivacy. You do not need to fill in a separate form for each broker.

The current sequence is:

verify California residency through the California Identity Gateway, with a direct information option or Login.gov
create a profile with the identifiers you choose to provide
submit the request and save the DROP ID
return to check broker-level outcomes

Name, date of birth, and ZIP code are enough to submit. Email addresses, phone numbers, former names, mobile advertising IDs, connected-TV IDs, and VINs are optional matching signals. Adding data can improve matching, but disclose only what you are comfortable using for this official process.

DROP opened for consumer requests on 1 January 2026. Registered brokers began processing them on 1 August 2026. CalPrivacy says brokers process requests at least every 45 days. They may take up to 90 days to report a result. For context on the dated June 2026 registry and signup figures, read California counted 581 data brokers.

DROP is California-only: DROP requires California residency verification and applies only to data brokers registered under California law. Australian residents cannot use DROP. They may use Australian privacy law to request access to, or correction of, information held by organisations and agencies.

Interpret each DROP status accurately

Status	What the official guidance says it can mean
Deleted	Matched covered data was deleted and will no longer be sold, while legally exempt information may remain
Exempted	The broker says all matched data it kept is exempt, such as certain public or health-related information
Opted-out	The broker could not make an exact match; it must stop selling information associated with the provided identifier as described by DROP
Record not found	The broker had no responsive record or could not locate one from the submitted data
Pending	The broker has not completed processing; it can have up to 90 days to report

"Record not found" is not proof that the broker has never held data. "Deleted" does not mean every public record on the internet disappeared. If the status says "Exempted", inspect the reason the broker gives. Do not assume the broker complied with or broke the law without checking that reason.

You can update a DROP profile when a name, phone, email, device identifier, or vehicle changes. CalPrivacy says the request includes current and future brokers registered with the agency, unless you narrow the list. Brokers must also address future matching data under DROP's rules.

Know what DROP does not remove

CalPrivacy identifies several boundaries. DROP does not necessarily delete:

information you gave directly to a business in a first-party relationship
publicly available information
information exempt under another rule or needed for a permitted purpose
a page from Google, Bing, a social platform, an archive, or the original public-record source

Some data may instead fall under health, financial, consumer-reporting, or other privacy laws. The CCPA also does not govern law-enforcement searches, and CalPrivacy explains that state-agency information is addressed through other protections. Use the regulator or record-holder route that fits the data.

Australian public records: In Australia, publicly available information is generally exempt from privacy obligations under the Privacy Act. You have a separate right to seek correction of personal information held by Australian organisations and agencies. If they refuse, you may ask them to attach a statement noting the claimed inaccuracy.

State and territory police services hold criminal records and must be contacted directly for access or correction requests.

Separate broker deletion from search-result removal

After a business or broker changes the source, search engines may still show an old result. Check the live page first. Use Google's or Bing's outdated-content route for stale snippets and pages that no longer exist. If the personal information is still live, check the search engine's removal policy. Use that route if the content qualifies.

Likewise, a search-engine approval does not complete a CCPA or DROP request. It reduces discovery of a URL; it does not direct the source business to delete its covered records.

Keep a California request ledger

For each request, record:

business or broker and its official privacy URL
right exercised
request and verification dates
minimum matching information provided
confirmation or DROP ID
response deadline and any extension notice
response and stated exception
complaint or appeal reference, if any
source, search, and broker verification dates

That ledger makes a regulator complaint, resubmission, or reappearance check specific and reproducible. Protect it carefully because it can connect several sensitive identifiers.

For the broker-by-broker layer, use the opt-out directory. For a result that remains in Google or Bing, use the search-result removal workflow.

Australian record-keeping: Keep similar records when using access or correction rights under Australian privacy law. Note who you contacted, when you made the request and what you supplied for verification. Save the response, timeframe and any OAIC or external dispute resolution complaint reference. These records help you follow up or make a complaint.

Privacy & Safety

Sources and references

Reviewed by DeepSearch Research and Safety Team on 23 October 2026. Re-check trigger: Any CCPA, CalPrivacy request, DROP eligibility, status, deadline, exemption, or complaint-process change

Rights under the California Consumer Privacy Act
California Privacy Protection Agency
The LOCKED rights to limit, opt out, correct, know, equal treatment, and delete subject to exceptions
Submit a privacy request
California Privacy Protection Agency
Finding official business channels, verification minimisation, 45-day response guidance, complaints, and DROP separation
How DROP works
California Privacy Protection Agency
Residency, required and optional identifiers, submission, status meanings, processing dates, future coverage, and exceptions
Personal information and data brokers
California Privacy Protection Agency
Broker data categories, matching, hashing, deletion scope, public-data exemptions, and other legal regimes
Additional protections
California Privacy Protection Agency
Separate health, financial, public-agency, law-enforcement, breach, identity-theft, child, and safety routes
Privacy Act 1988
Office of the Australian Information Commissioner
Australian context: California's CCPA and DROP system apply only to California residents and covered businesses under California law. Australian residents have separate rights under the Privacy Act 1988 and Australian Privacy Principles. These include access to, and correction of, personal information held by organisations and agencies.
Australian Privacy Principles
Office of the Australian Information Commissioner
Australian context: California's CCPA and DROP system apply only to California residents and covered businesses under California law. Australian residents have separate rights under the Privacy Act 1988 and Australian Privacy Principles. These include access to, and correction of, personal information held by organisations and agencies.
first complain directly to the entity
Office of the Australian Information Commissioner
Australian privacy complaints: You must first complain directly to the entity, whether it is an Australian organisation or agency. If it does not respond within 30 days, you may complain to the Office of the Australian Information Commissioner (OAIC). You may also complain if its response is unsatisfactory.

Continue reading

California counted 581 data brokers. Here is how to read the registry.As of 2 June 2026, CalPrivacy listed a record 581 brokers and 300,000+ DROP signups. How to read those numbers.Data-broker opt-out directory and process comparisonUse current official opt-out routes for DROP, DeepSearch, PeopleConnect, Spokeo, Whitepages, BeenVerified, and TruePeopleSearch.How to remove your personal information from people-search sitesHow to get yourself removed - starting with us - what California's DROP now forces data brokers to do, and why removal is maintenance, not a one-time fix.How to remove personal information from search resultsRemove personal information at the source, choose the right Google or Bing request, document exact URLs, and verify what actually disappeared.Why removed personal information reappearsUnderstand why removed personal information returns through new records, identity variants, relatives, search caches, and scope-limited opt-outs.