California privacy rights: deletion, opt-outs and DROP

California residents have several distinct privacy rights under the California Consumer Privacy Act, plus a statewide deletion mechanism for registered data brokers. The practical route is to choose the right request - know, delete, correct, opt out, or limit - send it through the business's official privacy channel, save the response, and use DROP for the registered-broker layer.

This guide reflects official CalPrivacy guidance checked on 23 October 2026. It is general information, not legal advice, and it does not claim that every business, record, or person is covered.

Philippines. Philippine privacy rights follow a separate process from California DROP. For a Philippine privacy concern, the National Privacy Commission explains data-subject rights, including access, correction and erasure or blocking subject to conditions. Use the current NPC complaint instructions if you need to raise a privacy complaint.

CalPrivacy summarizes the core CCPA rights as LOCKED:

Choose the remedy that matches the problem. If a company has the wrong address, a correction request may preserve a necessary account while fixing the risk. If you want it to stop selling covered data, an opt-out is not the same as closing the account. If you need to understand what exists first, begin with a know request.

The CCPA applies to covered businesses, not every person, nonprofit, government office, or record. Other state and federal laws can govern financial, health, credit, employment, education, communications, and public-sector information. Public records and other categories can also be exempt from a particular deletion mechanism.

Use the business's current privacy notice and CalPrivacy's guidance to determine which route it offers. For a difficult case, contested exception, or safety issue, consult a qualified California lawyer or an appropriate advocate.

CalPrivacy's current consumer workflow is:

1. Find the official privacy channel. Look for Privacy Policy, Do Not Sell or Share My Personal Information, Your California Privacy Choices, or similar language on the business's site.
2. Select the right. State whether you want to know, delete, correct, opt out, or limit covered processing. A single message can be ambiguous; name each requested action.
3. Provide only necessary matching information. A business may need to verify identity. CalPrivacy says you need provide only what it needs to complete the request and offers a complaint route if it demands excessive information.
4. Save the evidence. Record the request URL, date, confirmation, case number, scope, and information you supplied.
5. Track the response. CalPrivacy says businesses should respond within 45 days and may contact you if they need additional time.

Each business is normally a separate request. A deletion request to a retailer, for example, does not automatically reach an unrelated broker that obtained the same identifier elsewhere.

If the business ignores the request or you believe it did not follow the law, use the California Privacy Protection Agency's official complaint route. A complaint is stronger when it includes the exact request, confirmation, dates, response, and unresolved issue.

The Delete Request and Opt-out Platform is a separate, free mechanism for California residents. It sends one request to active data brokers registered with CalPrivacy rather than requiring a manual form for every broker.

The current sequence is:

1. verify California residency through the California Identity Gateway, with a direct information option or Login.gov
2. create a profile with the identifiers you choose to provide
3. submit the request and save the DROP ID
4. return to check broker-level outcomes

Name, date of birth, and ZIP code are enough to submit. Email addresses, phone numbers, former names, mobile advertising IDs, connected-TV IDs, and VINs are optional matching signals. Adding data can improve matching, but disclose only what you are comfortable using for this official process.

DROP opened for consumer requests on 1 January 2026. Registered brokers began processing them on 1 August 2026. CalPrivacy says brokers process requests at least every 45 days and may take up to 90 days to report their result. How to read the dated June 2026 registry and signup figures is California counted 581 data brokers.

“Record not found” is not proof that the broker has never held data. “Deleted” does not mean every public record on the internet disappeared. “Exempted” is an outcome to inspect, not silently translate into compliance or non-compliance without understanding the cited basis.

You can update a DROP profile when a name, phone, email, device identifier, or vehicle changes. CalPrivacy says current and future brokers registered with the agency are included unless the consumer narrows the list, and brokers must address future matching data within the mechanism's rules.

CalPrivacy identifies several boundaries. DROP does not necessarily delete:

• information you gave directly to a business in a first-party relationship
• publicly available information
• information exempt under another rule or needed for a permitted purpose
• a page from Google, Bing, a social platform, an archive, or the original public-record source

Some data may instead fall under health, financial, consumer-reporting, or other privacy laws. The CCPA also does not govern law-enforcement searches, and CalPrivacy explains that state-agency information is addressed through other protections. Use the regulator or record-holder route that fits the data.

After a business or broker changes the source, search engines may still show an old result. Verify the live page first, then use Google's or Bing's outdated content route for stale snippets and vanished pages. If the personal information is still live and meets a search engine's removal policy, use that policy route instead.

Likewise, a search-engine approval does not complete a CCPA or DROP request. It reduces discovery of a URL; it does not direct the source business to delete its covered records.

For each request, record:

• business or broker and its official privacy URL
• right exercised
• request and verification dates
• minimum matching information provided
• confirmation or DROP ID
• response deadline and any extension notice
• response and stated exception
• complaint or appeal reference, if any
• source, search, and broker verification dates

That ledger makes a regulator complaint, resubmission, or reappearance check specific and reproducible. Protect it carefully because it can connect several sensitive identifiers.

For the broker-by-broker layer, use the opt-out directory. For a result that remains in Google or Bing, use the search-result removal workflow.