If you found DROP through a link, a news article or a forum post, checking whether it is real before typing your personal information into it is the right instinct. Here is the short answer, and then how to confirm it without taking our word for anything.
DROP stands for the Delete Request and Opt-out Platform. It is operated by the California Privacy Protection Agency, a California state agency, and it exists because of a state law. It is not a private company, not a subscription service, and not a lead generation form dressed up as a government page.
How to verify it yourself
Do not trust a page because it looks official. Check three independent things instead. If all three line up, you are on a genuine state resource.
- 01Check the domain ending. Genuine California state sites end in .ca.gov. Look at the very end of the domain, immediately before the first single slash, not at the beginning. A site called privacy-ca-gov-delete.com or ca-gov-privacy.net is not a state site no matter what it says on the page.
- 02Check the agency. Search for the California Privacy Protection Agency independently and go to its own site at https://cppa.ca.gov/. Navigate to DROP from there, rather than from a link someone sent you.
- 03Check the law. The platform exists because of the California Delete Act, enacted as SB 362. You can read the bill on the Legislature's own site at https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB362.
That third step is the one people skip and it is the strongest. A fake service can copy a design and buy a convincing domain. It cannot make a bill appear in the Legislature's own database.
What DROP is for
Data brokers are businesses that collect and sell information about people they have no direct relationship with. You never signed up with them and in most cases you have never heard of them. Before the Delete Act, getting removed from their files meant finding each company individually and filing a separate request with each one, over and over.
DROP replaces that with one request. California requires data brokers to register with the state, and registered brokers are required to access the platform and process the deletion requests they find there. You submit once. The obligation to act sits with the brokers.
- What DROP is
- The Delete Request and Opt-out Platform
- Who runs it
- The California Privacy Protection Agency
- Why it exists
- The California Delete Act, enacted as SB 362
- Consumers could submit from
- January 2026
- Brokers had to begin processing
- August 1, 2026
- Broker check interval
- At least once every 45 days
What happens after you submit
Your request does not go out to companies one by one as an email. It becomes part of a list that registered data brokers are required to come and read on a schedule. That is why the timing works the way it does.
Registered brokers must access the platform at least once every 45 days. When a broker accesses it, it takes the current deletion list and checks it against its own records. Matching is done on scrambled versions of identifiers rather than on raw personal information, so a broker that holds nothing about you learns nothing about you from the process.
For each record that matches, the broker records an outcome and reports it back to the platform. The outcome is not always deletion. Some records are covered by lawful exemptions, which is a determination the business makes and has to be able to justify. That is why a request is not a guarantee that every trace of you disappears everywhere.
- The interval means results are not instant. A broker may be on day two of its cycle or day forty when your request lands.
- Only registered brokers see the list. A business that never registered is not reading it, which is a separate problem the agency enforces against.
- A record can be held under an exemption rather than deleted, and the business owns that call.
- You do not have to chase each company yourself. That is the point of the platform.
Common signs you are not on the real thing
- The domain does not end in .ca.gov.
- The page asks you to pay to have your data deleted from brokers under this program.
- It asks for information that has nothing to do with identifying you, such as bank details or account passwords.
- It promises to remove you from every company on the internet, which no single request can do.
- It pressures you with a countdown or a claim that your data will be sold within hours unless you act now.
If you are unsure about a page, close it and reach the platform by searching for the California Privacy Protection Agency and navigating from that agency's own site.
Checking whether a company is registered
California publishes the list of registered data brokers. If you want to know whether a specific company is on it, the state's registry is at https://cppa.ca.gov/data_broker_registry/. Each entry includes the business name and how to contact it. We also publish a searchable copy of the registry at the California data broker registry, sourced from the state's own data.
Official sources
- The California Privacy Protection Agency: https://cppa.ca.gov/
- The state's DROP information pages: https://privacy.ca.gov/drop-for-data-brokers/
- The public data broker registry: https://cppa.ca.gov/data_broker_registry/
- The bill behind the program: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB362
For the record: this site is run by a software company that sells tools to data brokers for handling their side of this process. We have no role in your request and no access to it. We wrote this page because the question of whether DROP is real deserves a straight answer rather than a sales page.