What Data Brokers Can Keep After a DROP Request: Exemptions Explained

If your DROP status page shows "Exempted" next to a broker, or a broker reports Deleted and your profile is still partly there, an exemption is the likely reason. A DROP request is a deletion request with legal force, but California law lists data that brokers are allowed to keep. This post goes through those exemptions from the statute itself, so you know what DROP can and cannot reach. For the bigger picture of what DROP misses, such as unregistered sites, see California DROP vs Data Removal Services.

The Short Version

CalPrivacy's How DROP works page names three kinds of data a broker does not have to delete after a DROP request:

• First-party data: information you gave directly to a business.
• Exempted data: information a statutory exemption lets the broker keep.
• Publicly available data.

When a broker matches you but keeps everything under an exemption, your status reads Exempted. DROP does not tell you which exemption applied. Here is what each category means in the law.

1. Companies That Are Not "Data Brokers" at All

DROP only goes to registered data brokers. Under Civil Code section 1798.99.80, a data broker is a business that knowingly collects and sells the personal information of consumers it has no direct relationship with. The same section excludes entities to the extent they are covered by:

• The federal Fair Credit Reporting Act (credit bureaus and background check companies, for their regulated activity).
• The federal Gramm-Leach-Bliley Act (banks and other financial institutions).
• California's Insurance Information and Privacy Protection Act (insurers).
• Health care covered entities and business associates, to the extent their processing is exempt under section 1798.146.

"To the extent" matters. A company can be outside the definition for its regulated business and still be a broker for other data it sells.

2. The CCPA's Deletion Exceptions

Section 1798.99.86(c)(2) says a broker does not have to delete information it needs to keep for a purpose listed in section 1798.105(d), the CCPA's general deletion exceptions. Paraphrased, those cover keeping data when it is reasonably necessary to:

• Complete a transaction, honor a warranty or recall, or provide a product or service you asked for.
• Protect the security and integrity of systems and data.
• Find and fix errors.
• Exercise free speech or another legal right.
• Comply with the California Electronic Communications Privacy Act.
• Do certain public-interest research, with your informed consent.
• Support internal uses in line with your reasonable expectations.
• Meet a legal obligation.

Most of these are tied to a specific need. None of them is a general license to keep selling your profile.

3. Data the CCPA Exempts Entirely

The same subdivision also points to section 1798.145, which carves out whole categories of data. According to section 1798.145, these include:

• Medical information under California's medical privacy law and protected health information under HIPAA.
• Consumer report activity regulated by the FCRA. This only applies to the extent the activity is FCRA-regulated. Selling the same data outside what the FCRA allows is not exempt.
• Financial data collected or shared under the GLBA or the California Financial Information Privacy Act.
• Driver data handled under the federal Driver's Privacy Protection Act.

If your concern is a credit report, DROP is the wrong tool. Credit reports are governed by federal law, which gives you a right to dispute errors with the bureaus.

4. Publicly Available Information

This is the exemption most people run into on people-search sites. The CCPA's definition of personal information in section 1798.140(v)(2) excludes publicly available information. That term covers information lawfully made available from federal, state or local government records, information a business reasonably believes you or widely distributed media made public, and information you shared with someone without restricting the audience. Biometric data collected without your knowledge does not count as publicly available.

Property records and court filings are examples of government records. So a broker can delete the profile it built and sold, but the underlying public record itself stays where it is. If a site rebuilds a page purely from public records, DROP may not reach that data.

5. First-Party Data

If you dealt with a company directly, for example by signing up for its service, the data you gave it is first-party data and DROP does not require its deletion. The final regulations narrowed this. A law-firm analysis explains that a business does not have a direct relationship with you just because it collects information directly. You have to intend to interact with it. Data the company bought about you from third parties, and inferences built on that data, remain subject to deletion.

For first-party data, use that company's own CCPA deletion process instead. Here is how to write a CCPA request.

What Brokers May Do With What They Keep

• Exempt data has a fenced purpose. Under section 1798.99.86(c)(3), data kept under an exemption may be used only for that exempt purpose, and not for any other purpose, including marketing.
• Unverified requests become opt-outs. Under (c)(1)(B), if a broker cannot verify your request, it must treat it as an opt-out of sale or sharing. In DROP that shows as Opted out.
• No new sales. Under (d)(2), after processing your request the broker may not sell or share new personal information about you, unless you ask otherwise or an exemption applies.
• Audits are coming. Under (e), brokers must undergo an independent compliance audit starting January 1, 2028, and every three years after.

What to Do If a Broker Says Exempted

1. Ask which exemption. Send the broker a written request asking which exemption it relied on and to delete anything that exemption does not cover. Keep the reply.
2. Check its public site. If an "exempt" broker is still selling a searchable profile of you, that is worth documenting with dated screenshots.
3. Report it. CalPrivacy's contact form has a "Data broker did not delete my data" option.
4. Read the status guide. California DROP Status Explained covers what to do for each result.

Frequently Asked Questions

Is Exempted the same as a refusal?

In practice, yes for that data. The broker matched you and says the law lets it keep the information. It may only use that data for the exempt purpose, though, not for marketing.

Can I appeal an exemption through DROP?

We did not find an appeal process inside DROP. Your options are a direct request to the broker and a complaint to CalPrivacy.

Does DROP delete my data from Google?

No. Google is not the broker. Once a broker removes a page, search results can drop it over time. See how to remove yourself from Google.

Will a removal service get around exemptions?

No. Exemptions apply to any deletion request, whoever sends it. A service can only send requests, follow up, and show you what each broker answered.