I Tried California's DROP Platform — Here's What Actually Happened

What Is DROP?

DROP stands for Delete Request Online Portal. It was created by the California Privacy Protection Agency (CPPA) as part of the Delete Act (SB 362), which Governor Newsom signed into law in October 2023. The idea is straightforward: instead of submitting separate opt-out requests to hundreds of data brokers one at a time, California residents can submit a single request through DROP and have it sent to every broker registered with the state.

It's free. It's government-backed. And on paper, it's exactly the kind of thing privacy advocates have been pushing for. We wanted to see how it works in practice — so we went through the entire process ourselves.

The Sign-Up Process

We submitted our first DROP request on January 1, 2026 — the day the portal went live. The process itself was simple and took about five minutes.

1. 1Navigate to the CPPA's DROP portal. The interface is clean and government-standard — nothing fancy, but functional.
2. 2Confirm California residency. You must attest that you currently live in California. There's no address verification at this stage.
3. 3Enter your personal information: full legal name, date of birth, phone number, email address, and current mailing address.
4. 4Verify your email. The CPPA sends a confirmation link to the email you provided.
5. 5Submit. You get a confirmation page stating that your request has been sent to all registered data brokers.

The form was clean and the instructions were clear. No complaints about the sign-up experience itself. This is genuinely easier than filling out opt-out forms on fifty different broker sites. Full credit to the CPPA for making the submission process painless.

What Happened After We Submitted

After submitting, the portal showed a confirmation message: your deletion request has been sent to all registered data brokers. And then... we waited.

We checked back after one week. No updates. The status simply read "processing." There was no breakdown of which brokers had received the request, which had acknowledged it, or which had taken any action.

We checked again after two weeks. Same thing. Processing. No additional detail.

At the 30-day mark, the status was still "processing." No broker-by-broker breakdown. No indication of how many brokers had received the request, how many had responded, or whether any deletions had actually occurred. Just one word: processing.

We Checked the Broker Sites Ourselves

Since DROP wasn't giving us any detail, we went and looked. About 45 days after submitting our DROP request, we manually searched for the profile we'd submitted across a dozen major people-search sites.

The results were discouraging:

To be fair, brokers technically have until August 1, 2026 to fully comply with the Delete Act's requirements. So it's possible some of these brokers will eventually act on the request. But 45 days in, most of the major sites we checked hadn't done anything visible.

The other problem: several of the people-search sites we checked aren't even registered with California. DROP can only send requests to brokers on the state's registration list. If a broker isn't registered — whether by choice, because they claim exemption, or because they operate under a different business entity — DROP can't reach them.

What DROP Gets Right

We don't want to be unfair here. DROP is a meaningful step forward, and there are things it does well. Credit where it's due:

What DROP Misses

The gaps are significant. DROP is a starting point, but it leaves a lot of the data broker problem untouched.

The Timeline Problem

Here's what the DROP experience actually looks like from the user's perspective — and what happens after the process is "complete."

The core issue is that data removal is not a one-time event. It's an ongoing process. Brokers don't just have your data — they have a pipeline for getting it again. Public records, social media scraping, data purchase agreements with other companies. DELETE your profile today, and it can be right back next month from a completely different source. DROP treats deletion as a single action. In reality, it's a continuous one.

DROP + GhostVault: The Complete Approach

If you're a California resident, our honest recommendation is to use both. DROP is free, and there's no reason not to submit a request through it. But don't stop there — because DROP alone leaves too many gaps.

Here's how the two work together:

DROP gives you the weight of the California state government behind your request. GhostVault gives you the ongoing monitoring, re-removal, breach alerts, and nationwide broker coverage that DROP doesn't provide. Together, they cover the full picture.

If you don't live in California, DROP isn't an option for you — but GhostVault works in all 50 states. The average American's personal information appears on more than 50 data broker sites. Whether you have access to DROP or not, those listings need active, ongoing management.

Our Honest Take

DROP is a good thing. It's the first time a US state has built a centralized tool for data broker deletion, and the legal penalties behind it are real. The $200/day fines for non-compliance will eventually force registered brokers to take these requests seriously. California is leading where the federal government hasn't.

But DROP is not a solution on its own. It covers only the brokers that registered with California. It submits your request once and doesn't follow up. It doesn't tell you what happened. And it does nothing about the data you've already lost in breaches — the passwords, SSNs, and financial records that are already circulating.

Think of DROP like filing a police report after a break-in. It's an important step. It creates a legal record. But it doesn't install the locks on your doors or set up the security cameras. That's what a data removal service does — it provides the ongoing, active protection that a one-time government filing can't.

Frequently Asked Questions