Remove Your Information From the Internet in California
California residents now have the strongest data deletion rights in the country. Here is how DROP works, what the August 1, 2026 deadline changes, and what the state platform still will not clear for you.
See what is published about you before you read on
The scan checks the data brokers and people-search sites in our catalog for your name and shows what each one publishes. No account needed.
No account needed. Adding a city and state is what lets us tell your record apart from everyone who shares your name.
California residents can remove their information from the internet three ways: submit one free deletion request through DROP, the state Delete Request and Opt-out Platform, which reaches every data broker on the official registry; send individual CCPA or CPRA delete requests to any business holding your data, which must be answered within 45 days; and opt out directly at the people-search sites that publish your address and phone number. DROP is the newest and the broadest, and from August 1, 2026 brokers face real penalties for ignoring it.
No other state has anything like this yet. If you live in California, you have leverage that residents of most other states simply do not, and it costs nothing to use. What follows is what the platform actually does, where it falls short, and how to combine it with the per-site work that still has to happen.
What is DROP, and what does it actually do?
DROP is a free platform run by the California Privacy Protection Agency. You create a profile, verify that you are a California resident, and submit a single deletion request. Every data broker registered with the state is then required to retrieve that request and delete the personal information it holds about you. One submission, hundreds of companies.
That is a genuine structural change. Before DROP, exercising your deletion rights against the broker industry meant finding each company, locating its opt-out form, completing it, confirming by email, and repeating that several hundred times. The Delete Act moved the burden onto the brokers: they have to come to the platform and check for requests, rather than waiting for you to find them.
The timeline matters, because the enforcement half only just arrived.
| Date | What changes |
|---|---|
| January 1, 2026 | DROP opens to California consumers. You can create a profile, verify residency, submit a deletion request, and check its status. |
| August 1, 2026 | Registered data brokers must begin processing DROP requests. Noncompliance carries a penalty of $200 per request per day. |
| Ongoing after August 1, 2026 | Brokers must check DROP at least every 45 days for new requests, and determine and act on each deletion within 90 days. |
If you submitted a request in the spring and nothing appeared to happen, that is why. The consumer side went live in January, but the obligation to act on those requests starts in August. Requests already sitting in the system are the ones brokers have to work through first.
How to submit a DROP request
Go to the CPPA's data broker pages at privacy.ca.gov, create a DROP account, and verify your California residency. The platform then asks for the identifiers brokers use to match records: your name, date of birth, phone number, email addresses, and device identifiers such as mobile advertising IDs.
Give it more than the minimum. This is the part people get wrong. A broker only deletes what it can confidently match to you, so a request carrying one name and one email will clear fewer records than one carrying your maiden name, three old email addresses, two phone numbers and your previous addresses. Every extra identifier is another key that unlocks another record. Adding an old address you lived at eight years ago is often what catches the listing that has been quietly following you around.
Then check back. DROP lets you see the status of your request and update your personal information later, which matters because you will move, change numbers, and pick up new identifiers over time.
What DROP does not cover
DROP only reaches companies that have registered as data brokers with the State of California. That is a large group, but it is not the whole internet, and the gap is where most people's remaining exposure sits.
- Unregistered sites. A site that publishes your address but has not registered as a broker is not on the list, and plenty have not registered. Some are simply out of scope, some are ignoring the requirement.
- Offshore operators. Sites hosted outside the United States that scrape and republish public records tend to ignore California law entirely, and the state has limited practical reach over them.
- Official public records. Property deeds, voter registration, court dockets, business filings and professional licenses are public by law. DROP does not touch them, and neither does anything else short of a court order or a statutory address confidentiality program.
- Search results themselves. Google is not a data broker in this sense. Even after a broker deletes your record, the search result can linger until the source page is recrawled, which is what Google's Results About You and Refresh Outdated Content tools are for.
- Breach data. Anything already leaked in a breach has been copied beyond recall. Rotate passwords, turn on two-factor authentication, and freeze your credit instead.
So DROP is the widest single lever available, not a complete solution. The practical approach is to submit the DROP request first, because it costs you twenty minutes and covers hundreds of companies at once, then work the data broker opt out list for the sites it misses.
Your other California right: the direct delete request
Separate from DROP, the CCPA and CPRA give you the right to demand deletion from any business that has collected your personal information, whether or not it is a registered broker. The business must confirm receipt within 10 days and substantively respond within 45 days, with one 45-day extension available if it explains why.
This is the tool for the specific company rather than the industry. An old retailer sitting on your address, a marketing firm that bought a list you appear on, a fitness app you abandoned in 2019. Say plainly that you are a California resident exercising your right to deletion under the CCPA as amended by the CPRA, list every identifier they might hold you under, and ask for written confirmation of what was deleted.
Worth knowing what happens on the other side, because it explains the delays. A company receiving your request has to hunt through a CRM, a warehouse, a support tool, an email platform and a pile of backups to find every copy of you, which is why an entire category of software exists to locate where a person's data lives inside a business before anyone can honestly confirm a deletion. Firms doing this by hand routinely miss systems, and that is frequently why a record you were told was deleted resurfaces later.
Do you still need a data removal service in California?
If you are patient and methodical, no. DROP plus a stack of direct delete requests plus manual opt-outs at the big people-search sites will get you most of the way, and every one of those steps is free. Californians genuinely can do more on their own than residents of any other state.
What you are buying with a service is the part after the first pass. Brokers rebuild constantly from county records, voter files and each other, so a profile deleted in February can reappear in September through a fresh ingest that the broker treats as a new record rather than a violation of your old request. DROP's 45-day recheck cycle helps, but it applies to registered brokers responding to requests on file, not to the unregistered sites republishing the same public records. Somebody has to keep watching and keep re-filing.
The other thing you are buying is evidence. If you ever need to show a court, an employer, a school or a platform that you took reasonable steps to keep your address private, dated before and after proof of each removal is worth considerably more than a dashboard claiming success. That matters most to people with an actual threat model: survivors of abuse, clinicians, judges, anyone who has already been doxxed.
For everyone else, be honest about your own follow-through. The first pass is satisfying. The fourth quarterly recheck, when three sites you already cleared are back, is where nearly everyone quits. If you know that is you, a subscription is buying those hours back permanently, and our comparison of data removal services lays out where each option is genuinely strongest, including where competitors beat us.
How long does removal take in California?
Expect the direct opt-outs at people-search sites to clear within a few days to two weeks. Direct CCPA delete requests take up to 45 days by statute. DROP requests submitted now fall under the 90-day determination window that starts running from the August 1, 2026 processing date. So a realistic full first pass, using every route, is roughly three to four months before things settle.
The search results are the last piece and the most visible one, which is why people misjudge progress. A broker can delete your record while Google still shows the old page for another week or two. Give it time, then use the search engine removal tools on whatever is still standing. If you want the full sequence rather than the California-specific part, we lay out the whole worklist in our guide to removing your information from the internet, and there is a separate walkthrough for getting your home address off the internet, which is the exposure most people care about first.
Start with what is actually published
Before you submit anything, find out what is out there. Run a free exposure scan on your name, look at which sites are carrying your address, phone number and relatives, and use that list to decide how much of this you want to handle yourself. A DROP request is worth submitting either way, since it is free and covers hundreds of companies in one go. What you learn from the scan is whether the remaining work is a weekend or a standing commitment.