California data privacy and data broker removal

By Delist Editorial Team · Updated August 28, 2026 · Corrections

California gives residents a broad set of privacy rights, including a free state platform that sends one deletion request to data brokers registered with the state.

Your rights in California

California residents are protected by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020.

• Right to access and know. Request a copy of the personal information a company holds about you.
• Right to delete. Ask a company to delete your personal information.
• Right to correct. Request fixes to inaccurate personal information.
• Right to opt out of sale. Tell a company to stop selling your personal information.
• Right to opt out of sharing. Stop companies from sharing your data for targeted advertising.
• Right to limit sensitive data use. Restrict how companies use your most sensitive data.
• Right to data portability. Get your data in a portable format you can take elsewhere.
• Right to appeal automated decisions. Opt out of significant decisions made about you by algorithm, and ask for human review.
• Non-discrimination. Companies can't penalize you for using these rights.

Does this cover the company that has my data?

Only larger companies are covered. A business must follow the law if it does business in California and meets any one of these thresholds:

• At least $25 million in annual gross revenue (adjusted yearly for inflation).
• Buys, sells, or shares the personal information of 100,000 or more California residents or households a year.
• Earns 50% or more of its annual revenue from selling or sharing personal information.

How to remove yourself from data brokers in California

California gives you more tools than most states. Here's how to use them, strongest first.

1. Use DROP: one request reaches registered brokers

California's DROP (the Delete Request and Opt-out Platform) lets an eligible California resident submit one verified request for data brokers registered with the state. It's free, state-run, and went live January 1, 2026. Brokers must process applicable requests subject to the Delete Act, its regulations, and permitted exceptions.

DROP is for eligible California residents and applies to data brokers required to register with California. It does not remove information from every website, search engine, public record, or organization outside that scope.

2. Turn on Global Privacy Control

Global Privacy Control is a free browser signal that communicates a request not to sell or share your data. California requires covered businesses to treat a valid signal as a request to opt out of sale or sharing, subject to the law and regulations.

3. File direct opt-out requests

For brokers the registry and GPC don't reach, you can file directly. Look for the "Do not sell my personal information" link in a company's website footer, or send a formal access, deletion, or correction request through its privacy policy page.

Covered companies must respond within the legal deadline. If they don't, you can file a complaint with the California Privacy Protection Agency or the Attorney General.

4. Automate ongoing removal

A broker may later ingest a new record from public records, data-sharing networks, or commercial databases. Re-listing timing varies by broker and source, so periodic checks matter.

California's data broker law: what it means for you

California's Delete Act (SB 362, 2023) created DROP, a free one-request deletion tool for eligible California residents that applies to data brokers required to register with the state. Statutory exemptions and broker compliance still matter.

Here's what the law actually requires:

• Covered brokers must register with the state annually and provide required disclosures.
• The state keeps a public registry of every broker at cppa.ca.gov, so anyone can see who's collecting and selling personal information.
• Missing the January 31 deadline costs $200 per day, plus the state's investigation costs.
• The California Privacy Protection Agency can enforce registration and Delete Act obligations.

Other privacy protections in California

Beyond the comprehensive privacy law, California has additional protections that may apply to you:

• Safe at Home, an address-confidentiality program for survivors of domestic violence, stalking, sexual assault, and related threats, run by the California Secretary of State.
• AB 45 (2025, effective January 1, 2026) limits collecting and using personal data near reproductive-health facilities and bans certain location tracking.
• Strong protections for minors. Companies need opt-in consent to sell or share the personal information of anyone under 16, and parental consent for anyone under 13.
• The Confidentiality of Medical Information Act protects your medical information.
• California has no standalone judge-protection law, though the federal Daniel Anderl Act protects federal judges nationwide.
• Biometric data. California has no standalone biometric-privacy law with a private right of action. Biometric information is treated as sensitive personal information under the CCPA and enforced by the state, unlike Illinois, where residents can sue directly.

How to file a privacy complaint in California

File with the California Privacy Protection Agency at cppa.ca.gov (consumer complaint portal), or the California Attorney General at oag.ca.gov/privacy/ccpa.

Most state agencies enforce privacy law in the aggregate, investigating patterns of violations rather than settling individual disputes. Filing still matters: your complaint creates a record that can trigger enforcement.

Frequently asked questions