California DROP Goes to 30 Days in 2027 (AB 883 Explained)
California's DROP lets you send one deletion request to every registered data broker. Since August 1, 2026, brokers have had to check it at least once every 45 days. AB 883, signed September 27, 2026, cuts that to 30 days. Here is what changes, when, and what does not.
The Short Version
- 30 days, not 45: registered brokers must access DROP at least once every 30 days to pick up deletion requests.
- Starts January 1, 2027: the default effective date for California laws passed in 2026.
- Judges and elected officials: new notice and enforcement rules for their deletion requests, operative July 1, 2027.
- Nothing for you to redo: if you already filed a DROP request, it stays on file.
What the Law Says
The amended Civil Code section 1798.99.86 reads: a data broker "shall access the accessible deletion mechanism ... at least once every 30 days." The Legislature's own digest puts it in one line: the bill "would change the above-described 45-day period to a 30-day period and make conforming changes."
Each time a broker checks DROP, it still has to process the deletion requests it finds and tell its service providers and contractors to delete too. AB 883 makes brokers come back to the list more often.
Why 15 Days Matters
Brokers re-collect data all the time from public records, marketing lists and other brokers. Under the 45-day rule, a new record could sit on a people-search site for up to about six weeks before the next required check. At 30 days, that gap shrinks by a third. Over a year, that is about 12 required check-ins instead of about 8.
It does not mean a broker deletes you within 30 days of your first request. It means brokers have to come back to the list more often.
Judges and Elected Officials
From July 1, 2027, the bill makes state and local offices tell elected officials and judges about DROP. It also lets the Attorney General, a county counsel or a city attorney bring a civil action on behalf of an elected official or judge when a broker does not comply. For most Californians, the 30-day change is the part that matters.
What AB 883 Does Not Change
- Who is covered. DROP still only reaches brokers registered with the California Privacy Protection Agency. Sites that never registered are outside it. See what DROP does not cover.
- Other businesses. The ordinary CCPA right to delete, for companies you deal with directly, is unchanged.
- Proof. DROP shows a status each broker reports, such as Deleted or Record not found, not the broker's written reply. CalPrivacy says status updates can take up to 90 days. See what each DROP status means.
- Who can use it. DROP is for California residents.
What to Do Now
- File a DROP request if you live in California and have not. Our step-by-step DROP guide takes about ten minutes.
- Check the sites DROP misses. Search your name on the big people-search sites. The opt-out steps for each are in our free guides.
- Outside California, use your own state's law. The free deletion letter generator writes the request.
Where GhostVault fits
DROP covers registered brokers for Californians. GhostVault sends deletion requests directly to the brokers on the California, Vermont and Oregon registries, for residents of any state, follows up when they stay silent, and shows you each broker's written reply. A request is not a removal until the broker confirms it. The free scan shows where you are listed today. First month $1, then $7.99/mo. Cancel anytime.
Frequently Asked Questions
Is AB 883 law yet?
Yes. Governor Newsom approved it on September 27, 2026, and it was chaptered the same day as Chapter 507, Statutes of 2026.
Can I submit DROP requests more often now?
AB 883 is about how often brokers check the platform. It does not ask consumers to do anything new.
Where can I read the bill?
The bill text, history and votes are on Digital Democracy's AB 883 page. The official site is the California Legislative Information site.