California privacy rights and data removal
California gives residents a broad set of privacy rights, including a free state platform that sends one deletion request to data brokers registered with the state.
At a glance
- Comprehensive privacy law? Yes. California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA/CPRA)
- In effect since Jan 1, 2020
- Your core rights Access & Know, Delete, Correct, Opt Out of Sale +3 more
- Law requires honoring Global Privacy Control? Yes, for covered businesses
- Data-broker registry? Yes
- Can you sue? (private right of action) Limited (data breaches only)
- Enforced by California Privacy Protection Agency + Attorney General
Request scope in California
California recognizes an authorized agent for covered opt-out requests under the California Consumer Privacy Act (CCPA), as amended by the CPRA. Agent eligibility depends on the request type, authorization, verification and the business’s coverage under the law. This legal framework does not establish that a service currently files a particular request.
California also recognizes agent-submitted deletion requests, subject to verification and applicable limits. Eligible California residents can use DROP for registered data brokers; direct business requests are a separate route. This page does not establish that Delist submits DROP requests.
Basis: Cal. Civ. Code § 1798.135 (CCPA); § 1798.99.86 (Delete Act / DROP). Reviewed September 1, 2026. How the three groups work: our authorized-agent framework.
Your rights in California
California residents are protected by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020.
- Right to access and know. Request a copy of the personal information a company holds about you.
- Right to delete. Ask a company to delete your personal information.
- Right to correct. Request fixes to inaccurate personal information.
- Right to opt out of sale. Tell a company to stop selling your personal information.
- Right to opt out of sharing. Stop companies from sharing your data for targeted advertising.
- Right to limit sensitive data use. Restrict how companies use your most sensitive data.
- Right to data portability. Get your data in a portable format you can take elsewhere.
- Right to appeal automated decisions. Opt out of significant decisions made about you by algorithm, and ask for human review.
- Non-discrimination. Companies can't penalize you for using these rights.
Does this cover the company that has my data?
The CCPA generally covers for-profit businesses that collect personal data, decide how it is processed, do business in California and meet at least one threshold:
- $26.625 million or more in gross annual revenue for the preceding calendar year (effective January 1, 2025).
- Buys, sells, or shares the personal information of 100,000 or more California residents or households a year.
- Earns 50% or more of its annual revenue from selling or sharing California residents’ personal data.
Some controlled entities, joint ventures and voluntarily certified businesses are also covered. The Delete Act’s broker definition relies on the CCPA definition of business; registration does not remove these coverage requirements.
- DROP went live for consumers on January 1, 2026. Since August 1, 2026, brokers must access DROP at least every 45 days and process applicable requests. First independent audits begin January 1, 2028.
- SB 361 (2025) expanded what brokers must disclose.
- AB 45 reproductive-health-data protections took effect January 1, 2026.
- New CCPA rules on risk assessments, cybersecurity audits, and automated decision-making phase in from January 1, 2026; the automated-decision opt-out starts January 1, 2027.
- AB 566, the Opt Me Out Act, requires browsers to offer opt-out signals by January 1, 2027.
How to remove yourself from data brokers in California
California gives you more tools than most states. Here's how to use them, strongest first.
1. Use DROP: one request reaches registered brokers
California's DROP (the Delete Request and Opt-out Platform) lets an eligible California resident submit one verified request for data brokers registered with the state. It's free, state-run, and went live January 1, 2026. Brokers must process applicable requests subject to the Delete Act, its regulations, and permitted exceptions.
DROP is for eligible California residents and applies to data brokers required to register with California. It does not remove information from every website, search engine, public record, or organization outside that scope.
2. Turn on Global Privacy Control
Global Privacy Control is a free browser signal that communicates a request not to sell or share your data. California requires covered businesses to treat a valid signal as a request to opt out of sale or sharing, subject to the law and regulations.
3. File direct opt-out requests
For brokers the registry and GPC don't reach, you can file directly. Look for the "Do not sell my personal information" link in a company's website footer, or send a formal access, deletion, or correction request through its privacy policy page.
Covered companies must respond within the legal deadline. If they don't, you can file a complaint with the California Privacy Protection Agency or the Attorney General.
4. Check for reappearance
A broker may later ingest a new record from public records, data-sharing networks, or commercial databases. Re-listing timing varies by broker and source, so periodic checks matter.
Check the exact listing and the provider’s current privacy instructions. Rights depend on residence, request type, business coverage and exemptions. A scan, opt-out preference or submission receipt does not establish deletion.
Run a free scan →California's data broker law: what it means for you
California's Delete Act (SB 362, 2023) created DROP, a free one-request deletion tool for eligible California residents that applies to data brokers required to register with the state. Statutory exemptions and broker compliance still matter.
Here's what the law actually requires:
- Covered brokers must register with the state annually and provide required disclosures.
- The state keeps a public registry of every broker at cppa.ca.gov, so anyone can see who's collecting and selling personal information.
- Missing the January 31 deadline costs $200 per day, plus the state's investigation costs.
- The California Privacy Protection Agency can enforce registration and Delete Act obligations.
Other privacy protections in California
Beyond the comprehensive privacy law, California has additional protections that may apply to you:
- Safe at Home, an address-confidentiality program for survivors of domestic violence, stalking, sexual assault, and related threats, run by the California Secretary of State.
- AB 45 (2025, effective January 1, 2026) limits collecting and using personal data near reproductive-health facilities and bans certain location tracking.
- Strong protections for minors. Companies need opt-in consent to sell or share the personal information of anyone under 16, and parental consent for anyone under 13.
- The Confidentiality of Medical Information Act protects your medical information.
- California has no standalone judge-protection law, though the federal Daniel Anderl Act protects federal judges nationwide.
- Biometric data. California has no standalone biometric-privacy law with a private right of action. Biometric information is treated as sensitive personal information under the CCPA and enforced by the state, unlike Illinois, where residents can sue directly.
How to file a privacy complaint in California
File with the California Privacy Protection Agency at cppa.ca.gov (consumer complaint portal), or the California Attorney General at oag.ca.gov/privacy/ccpa.
Most state agencies enforce privacy law in the aggregate, investigating patterns of violations rather than settling individual disputes. Filing still matters: your complaint creates a record that can trigger enforcement.
Check a DROP request separately
Use CalPrivacy’s current DROP help for residency-review problems, access to your request and recovery of your private DROP ID. “Record not found” means the broker could not match the supplied information; it does not prove that no data exists. Keep the ID private and inspect each broker’s status rather than treating a submission as completed deletion.
Frequently asked questions
Does California have a data privacy law?
Yes. California residents are protected by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA/CPRA), which gives you rights to access, delete, and control your personal data.
Can I sue a company for violating my privacy in California?
Only for data breaches. California allows lawsuits for data breaches but general privacy violations are enforced by the state agency, not individual litigation.
How do I opt out of data brokers in California?
Check the exact listing and the provider’s current privacy instructions. Rights depend on residence, request type, business coverage and exemptions. A scan, opt-out preference or submission receipt does not establish deletion.
Does California require websites to honor Global Privacy Control?
Yes. California law requires covered businesses to treat Global Privacy Control as a valid opt-out request. GPC does not request deletion or confirm that a listing was removed.
Is there a data broker registry in California?
Yes. California requires data brokers to register with the state. The public registry lets you see which brokers are collecting and selling personal information.
What is DROP and how do I use it?
DROP is California's free Delete Request and Opt-out Platform. An eligible California resident can submit one verified request for registered data brokers to process under the Delete Act and its regulations. It launched January 1, 2026 at privacy.ca.gov; brokers began processing applicable requests on August 1, 2026.
Sources
This page is privacy-rights information, not legal advice. Privacy law changes often; confirm current rules with your state privacy agency or a licensed attorney before acting. Later edits corrected specific statements; no full legal re-review is recorded.
Request scope reviewed . CCPA coverage and Delete Act business eligibility only. Other state-law details have not been re-verified in this review. See the CPPA guidance.