California DROP: Is It Working, and What Should Employers Do?
By Tom Daly, Founder and CEO, Priwall by mePrism · October 2026
Key takeaways
-
California DROP is showing results. The state's free tool lets residents request deletion from registered data brokers at once. More than 560,000 Californians have signed up, and brokers report deleting close to 100 million consumer profiles since August 1.
-
The results have limitations. Deletion figures are self-reported by brokers, some information can be marked "exempt," and every request begins with an individual verifying their California residency.
-
Employers should go further. Encourage California employees to use DROP, then protect executives and high-risk staff nationwide with removals that are regularly rechecked and documented.
What happened in DROP’s first three months?
Three months ago I called August 1 “Day One.” It was the day data brokers had to start honoring deletion requests sent through California’s Delete Request and Opt-out Platform, known as DROP. Now there are results, and most of them are good.
CalPrivacy, California’s privacy agency, marked its first Delete Week on October 12. It said more than 560,000 Californians have registered for DROP, brokers have reported deleting close to 100 million consumer profiles, and a typical user has had their information reported deleted by more than 150 brokers (CalPrivacy). On August 25, a typical user’s count was just over 40 brokers (CalPrivacy).
The legislature is pushing further. AB 883, signed this session, shortens the deadline for processing DROP requests from 45 days to 30. It also requires certain government officials to tell other officials that they can use DROP (Inside Privacy). And brokers active in DROP have until October 29 to finish at least one full processing cycle (National Law Review).
California DROP by the numbers
| Measure | Figure | As of | Source |
|---|---|---|---|
| Californians registered | 560,000+ | October 12, 2026 | CalPrivacy |
| Consumer profiles reported deleted | Close to 100 million | October 12, 2026 | CalPrivacy |
| Brokers reporting deletion for a typical user | 150+ Up from 40+ on August 25 | October 12, 2026 | CalPrivacy |
| Users with data deleted by at least 1 broker | 99% | First three months | CalPrivacy DROP FAQ |
| Users with data deleted by 100+ brokers | 70% | First three months | CalPrivacy DROP FAQ |
| Registered data brokers | 660+ | October 12, 2026 | CalPrivacy |
| Processing deadline | 45 days Falling to 30 days | 30 days from January 1, 2027 | National Law Review |
| Penalty for failing to delete | $200 per consumer per day | Current law | CalPrivacy DROP FAQ |
The more important point is what the state is now saying out loud. Deleting your data from brokers is a basic safety step. It isn’t fringe privacy advice anymore. It’s a government program with an awareness week, run by people who want more Californians using it.
If you live in California, sign up. It’s free and takes a few minutes. Then keep reading, because a security leader should take something else from these numbers.
Why does broker deletion matter for safety?
People sometimes treat broker exposure as an abstract privacy problem. The Minnesota case shows why it isn’t.
When Vance Boelter was arrested for the June 2025 murders of former Minnesota House Speaker Melissa Hortman and her husband Mark, investigators found a notebook in his car. It listed 11 people-search sites (FOX 9), including Spokeo, Whitepages, BeenVerified, Intelius, TruePeopleSearch, PeopleFinders and TruthFinder (The Beltway Report). Each name links to our free opt-out guide for that site. According to the FBI affidavit, he had also written that “most property records in America are public” (Politico).
The public record has not established whether he used those sites or a state directory to find the Hortmans’ address (Star Tribune). Federal prosecutors said he “extensively researched his intended targets” before he was sentenced in July to two consecutive life terms plus 40 years (U.S. Attorney’s Office, District of Minnesota).
You don’t need that case to settle the question. It’s enough that someone planning violence considered these sites worth listing, with notes on which ones were free.
Corporate targets face their own version. Semperis surveyed 1,200 IT and security professionals at organizations that had suffered disruptive ransomware attacks. A quarter reported doxxing that affected employees or their families, and 23% reported swatting (GBHackers). That survey covers nine countries, and the researchers say these tactics are less common in the Americas than in Europe and the Middle East (BankInfoSecurity). Still, the direction is clear. As companies get better at refusing to pay, some attackers go after the people who work there. Bruce Schneier made the national-security version of this argument to Congress years ago (Priwall by mePrism).
What doesn’t California DROP cover for employers?
DROP was built for individual Californians, and it serves them well. A security team should still read the results with four facts in mind.
Each person has to verify their own residency. By law, DROP is for California residents only, and every request starts with that person verifying their residency through the state’s identity gateway (CalPrivacy DROP FAQ). An authorized agent can help after that, with the person’s permission (CalPrivacy), but an employer can’t enroll a team in bulk. An executive who lives in Texas, Florida or New York can’t use DROP at all.
The deletions are self-reported. CalPrivacy is careful to call them profiles “reported deleted” by brokers. That’s how the system works: brokers compare scrambled (hashed) identifiers against their own records and report a status back to DROP (CalPrivacy DROP FAQ). A report isn’t independent verification, and the industry’s track record shows why the difference matters. A Stanford study of 522 registered brokers found that fewer than 1 in 10 fully complied with California’s existing transparency requirements. In a sample of 250 brokers’ request processes, 43% made people submit the same information more than once (East Bay Times). CalPrivacy’s executive director called that finding “really concerning.”
“Exempt” is a real status. DROP reports five possible outcomes: deleted, exempt, opted-out, record not found and pending. Information you gave a broker directly, or information that is publicly available, such as public records, can be exempt from deletion under the Delete Act (CalPrivacy DROP FAQ). A DROP user who sees that status should understand it means the broker kept that information.
Coverage depends on registration. DROP reaches brokers registered with California, now more than 660 (CalPrivacy). CalPrivacy has fined more than a dozen brokers for failing to register (East Bay Times), which tells you some companies that belong in the system aren’t in it.
None of this is a criticism of DROP. It’s a description of what a state consumer-rights tool is built to do. It isn’t built to protect a workforce.
What should employers do about California DROP?
Start by encouraging DROP. If you have California employees, tell them it exists, show them how to sign up, and point them to their DROP ID so they can check their status. It costs nothing and it raises the floor for everyone. If your company offers privacy protection as an employee benefit, add DROP enrollment to the onboarding instructions.
Then look honestly at what’s left. Executives, finance and HR staff, IT administrators, and anyone a social engineer would want to impersonate or pressure should be covered by something that:
Works for employees in every U.S. state, not just California
Files removals with people-search sites and brokers directly
Rescans to confirm removals held and resubmits when listings reappear
Gives the security team evidence of what was removed, not just a status someone else reported
That’s the work Priwall by mePrism does. Priwall removes employees’ and executives’ data from U.S.-based data brokers and people-search sites, and it covers international executives who have a U.S. address. It doesn’t cover brokers outside the U.S. We file as an authorized agent, rescan and resubmit continuously, cover family members, and give security teams proof of removal. We recommend that every California-resident customer file a DROP request too. The two work better together.
California has done the country a favor. It has made broker deletion something a state recommends as a matter of course, and its numbers show that brokers will delete when they have to. Employers should take the hint, use what the state offers, and cover the people it can’t reach.
Want to know how exposed your executives and employees are right now? Talk to Priwall
What should employers do about California DROP?
-
Encourage employees to use DROP
Start by encouraging DROP. If you have California employees, tell them it exists, show them how to sign up, and point them to their DROP ID so they can check their status. It costs nothing and it raises the floor for everyone.
If your company offers privacy protection as an employee benefit , add DROP enrollment to the onboarding instructions.
-
Identify employees who need additional protection
Then look honestly at what's left. Executives, finance and HR staff, IT administrators, and anyone a social engineer would want to impersonate or pressure should be covered by something that:
- Works for employees in every U.S. state, not just California
- Files removals with people-search sites and brokers directly
- Rescans to confirm removals held and resubmits when listings reappear
- Gives the security team evidence of what was removed, not just a status someone else reported
-
Combine state protections with ongoing removal
DROP provides a free deletion mechanism for California residents. Employers should combine it with direct broker removals, ongoing monitoring, and verification to protect employees beyond California and address information that reappears.
Protection beyond California DROP
That's the work Priwall by mePrism does. Priwall removes employees' and executives' data from U.S.-based data brokers and people-search sites, and it covers international executives who have a U.S. address. It doesn't cover brokers outside the U.S.
We file as an authorized agent, rescan and resubmit continuously, cover family members, and give security teams proof of removal. We recommend that every California-resident customer file a DROP request too. The two work better together.
California has done the country a favor. It has made broker deletion something a state recommends as a matter of course, and its numbers show that brokers will delete when they have to. Employers should take the hint, use what the state offers, and cover the people it can't reach.
Frequently asked questions
Is California’s DROP working?
By CalPrivacy’s numbers, yes. In the first three months of processing, 99% of users had their information deleted by at least one data broker, and 70% had it deleted by 100 or more brokers (CalPrivacy DROP FAQ). These results are reported by the brokers.
How many people have used California DROP?
More than 560,000 Californians had registered as of CalPrivacy’s Delete Week on October 12, 2026. Brokers had reported deleting close to 100 million consumer profiles (CalPrivacy).
Can an employer enroll employees in DROP?
Not in bulk. Each person must verify their own California residency before a request can be submitted. An authorized agent can then help with that person’s permission (CalPrivacy).
What does “exempt” mean on a DROP request?
It means the broker reported that some of your information is exempt from deletion under the Delete Act. Common examples are information you gave the broker directly and publicly available information, such as public records (CalPrivacy DROP FAQ).
What changes for DROP in 2027?
AB 883 shortens the deadline for processing DROP requests from 45 days to 30 (Inside Privacy), starting January 1, 2027 (National Law Review).
Should I use DROP if I already use a data removal service?
Yes, if you’re a California resident. DROP is free, the state can fine brokers $200 per consumer per day for failing to delete (CalPrivacy DROP FAQ), and it works alongside a service that files removals directly and checks the results.
At Priwall by mePrism, we remove personal information from 700+ data brokers and people-search sites, for individuals and for companies protecting their employees and executives. See what's exposed about you.
Ready to try Priwall by mePrism?
If you're a company protecting at-risk employees, or an individual concerned about your digital footprint, start your privacy removal today at mePrism.com
Because your data shouldn’t be a roadmap for violence.
Tom Daly is the founder and CEO of Priwall by mePrism, the enterprise open-source data-removal platform used by security, executive-protection and digital-risk teams to shrink broker exposure across U.S. data brokers and people-search sites.
