Comparison
California DROP vs Data Removal Services: What DROP Doesn't Cover
California launched the DELETE Request Online Portal (DROP) on January 1, 2026. It's a free platform that lets state residents request data broker deletions in one place. Good idea. But DROP has real limitations, and relying on it alone still leaves your data exposed on hundreds of sites. This is what it covers, what it misses, and where a paid removal service picks up the slack.
What Is California DROP?
DROP stands for DELETE Request Online Portal. It was created by the California Privacy Protection Agency (CPPA) under the California Delete Act (SB 362), which Governor Newsom signed in October 2023. The platform went live on January 1, 2026, at privacy.ca.gov/drop.
The idea is straightforward: instead of contacting hundreds of data brokers individually to request deletion, California residents can submit a single request through DROP. The portal forwards that request to all data brokers registered with the state. Brokers then have 90 days to process the deletion.
No other state has anything like it. California built the first centralized data broker deletion tool in the country, and the concept is solid. But concept and execution are different things.
Quick Facts: California DROP
- Launched: January 1, 2026
- Operated by: California Privacy Protection Agency (CPPA)
- Cost: Free
- Eligibility: California residents only
- Brokers covered: ~500 CA-registered data brokers
- Compliance deadline: Brokers have 90 days to process each request
- Enforcement: $200/day penalty per request begins August 1, 2026
- Ongoing monitoring: None — one-time request only
- Breach monitoring: Not included
How DROP Works
The DROP process is designed to be simple. Here's what happens when you submit a request:
- 1You visit privacy.ca.gov/drop and verify your identity as a California resident.
- 2You submit a single deletion request through the portal.
- 3DROP forwards your request to all data brokers currently registered with the state of California.
- 4Each broker has 90 days to process the deletion and remove your personal information.
- 5That's it. There's no follow-up, no verification, and no ongoing monitoring.
One request, all registered brokers. That part is genuinely useful compared to submitting individual opt-outs. But the process ends there. If a broker re-lists your data six months later (and most do), DROP won't catch it or re-submit on your behalf.
What DROP Gets Right
Credit where it's due. DROP does several things well, and it costs you nothing.
It's completely free
No cost to submit requests. This matters for people who can't afford a paid removal service.
One-stop submission
A single form covers all CA-registered brokers. No need to contact each one individually.
Government-backed enforcement
Starting August 2026, non-compliant brokers face $200/day penalties per request. That's real leverage.
Raises the baseline
Even if it's imperfect, DROP creates a floor of protection that didn't exist before.
Sets a national precedent
Other states are watching California. DROP could lead to federal data broker regulation.
Covers registered brokers
Roughly 500 data brokers are registered with California, including many of the largest players.
What DROP Doesn't Cover
DROP's gaps are not minor. If you stop at DROP and assume you're covered, you're not.
California residents only
If you live in Texas, Florida, New York, or any other state, you cannot use DROP. There's no equivalent program anywhere else in the US. The 270+ million Americans outside California are left without a government-backed option.
Only covers CA-registered brokers
DROP only sends requests to data brokers that are registered with the California Privacy Protection Agency. Brokers that operate without registering — or that aren't based in California — fall outside DROP's reach. Many smaller, less scrupulous brokers don't bother registering.
One-time request, no ongoing monitoring
DROP submits your deletion request once. Data brokers routinely re-collect and re-list personal information within weeks or months of a removal. DROP doesn't re-scan for your data or re-submit requests. You'd need to manually go back and submit again.
No verification of actual removal
DROP sends the request, but it doesn't confirm that brokers actually followed through. There's no audit trail showing whether your data was deleted, partially deleted, or ignored. You have no way to know if the request worked without checking each broker yourself.
90-day compliance window
Brokers have a full 90 days to comply with each request. That's three months where your data remains exposed. Direct CCPA requests from removal services typically result in deletion within 7 to 45 days.
Excludes FCRA-exempt data
DROP cannot touch data that falls under the Fair Credit Reporting Act — credit reports, insurance records, employment screening data, and health information. These categories are exempt from the California Delete Act.
No breach monitoring or dark web alerts
DROP only handles data broker deletions. It won't alert you if your email, passwords, Social Security number, or financial details appear in data breaches or dark web marketplaces.
No enforcement until August 2026
The $200/day penalty for non-compliance doesn't take effect until August 1, 2026. Until then, brokers face no legal consequences for ignoring DROP requests. Early adopters are relying entirely on voluntary compliance.
DROP vs Data Removal Service vs DIY
Three ways to deal with data brokers. Here's what each one actually gets you:
| Feature | California DROP | GhostVault | DIY (Manual) |
|---|---|---|---|
| Cost | Free | $3.99/mo or $39/year | Free (your time) |
| Who can use it | CA residents only | Anyone in the US | Anyone |
| Brokers covered | ~500 (CA-registered) | 500+ (registered & unregistered) | As many as you find |
| Time to remove | Up to 90 days | 7-45 days | Varies widely |
| Ongoing monitoring | No | Yes — automatic re-removal | Only if you keep checking |
| Removal verification | No | Yes — real-time dashboard | Manual checking |
| Breach monitoring | No | Yes — dark web + breach alerts | No |
| Unregistered brokers | Not covered | Covered | If you can find them |
| Time investment | ~10 minutes | ~5 minutes to set up | 50+ hours |
| Free scan before paying | N/A (free service) | Yes | N/A |
The Re-Listing Problem
This is the single biggest issue with any one-time deletion request, DROP or otherwise.
Data brokers don't collect your information once and sit on it. They buy, scrape, and aggregate data from public records, social media, purchase histories, app usage, and dozens of other sources. It never stops. When you get your data removed from a broker, they often re-acquire and re-list it within weeks.
DROP handles the initial deletion. It does not handle what comes after. Say Spokeo removes your profile in March. By June, it's back up. DROP won't notice and won't re-submit.
GhostVault re-scans broker sites on a recurring basis and automatically re-submits removal requests when your information reappears. That ongoing loop is what actually keeps your data off these sites long-term.
Registered vs Unregistered Brokers
California requires data brokers to register with the state. About 500 have. DROP only covers those registered brokers.
Plenty of brokers don't bother registering. Smaller operations, offshore sites, newer companies. Some don't know they need to. Some just ignore it. Either way, they still have your data, and DROP can't touch them.
GhostVault doesn't rely on the state registry. It maintains its own database of 500+ data brokers, registered and not, and sends direct CCPA deletion demands to each one. Same legal basis (California Consumer Privacy Act), wider net.
What If You Don't Live in California?
Then DROP doesn't exist for you. It's California residents only. No exceptions.
Virginia, Colorado, Connecticut, Oregon, Texas, and a handful of other states have passed data privacy laws, but none of them built a centralized deletion portal. If you're in those states, you're still submitting opt-out requests to each broker individually.
GhostVault sends CCPA-based deletion requests on behalf of users in all 50 states. The CCPA applies to businesses that operate in California or handle California consumer data, which is basically every major data broker. The legal mechanism works whether you're in Orlando or Omaha.
The Best Move: Use Both
If you're a California resident, use DROP and a removal service. They cover different ground.
- 1.Submit through DROP first. It's free, takes 10 minutes, and sends your request to all registered brokers. This puts the government enforcement mechanism behind your request — brokers know a $200/day penalty is coming if they don't comply.
- 2.Set up a data removal service to cover the gaps. GhostVault handles the unregistered brokers that DROP can't reach, monitors for re-listings that DROP doesn't catch, and provides breach monitoring that DROP doesn't offer.
- 3.Let them overlap. DROP gives you regulatory teeth. A removal service gives you speed and ongoing coverage. The overlap is the point.
If you're not a California resident, a data removal service is your only realistic option for broad coverage. The DIY route is technically possible but requires 50+ hours of work to submit individual requests, plus ongoing effort to check for re-listings.
What GhostVault Adds
Specifically, what you get from GhostVault that DROP doesn't give you:
Nationwide coverage
Works for residents of all 50 states, not just California. You don't need to be a CA resident to use CCPA-based deletion requests.
Registered and unregistered brokers
GhostVault's broker database includes sites that aren't registered with California, closing the gap that DROP leaves open.
Ongoing monitoring and re-removal
Continuous scans detect when brokers re-list your data and automatically re-submit removal requests. No manual follow-up required.
Faster removals
Direct CCPA demands typically result in removals within 7-45 days, compared to DROP's 90-day compliance window.
Dark web and breach monitoring
Alerts you when your email, passwords, or personal information appear in data breaches or dark web marketplaces.
Real-time dashboard
See exactly which brokers have your data, which removals are pending, and which are complete — all in a live dashboard instead of waiting for quarterly updates.
Free scan before you pay
Run a free exposure scan to see what data brokers have on you before committing to a subscription. No credit card required.
DROP Enforcement After August 2026
Starting August 1, 2026, the CPPA can fine data brokers $200 per day, per request, for failing to comply with DROP deletions. A broker that ignores 1,000 requests for 30 days? $6 million in potential penalties. That's real money.
This is probably DROP's strongest long-term card. Government fines create pressure that a private deletion email can't. Registered brokers will almost certainly comply once enforcement starts.
But the enforcement only covers registered brokers, and only for DROP requests. Unregistered brokers face no DROP-specific penalties. And until August, compliance is voluntary. Early adopters are trusting that brokers will do the right thing with no consequence for not doing it.