CCPA Data Broker Opt-Out Guide 2026: Use California Law to Remove Your Data
California residents can use applicable CCPA rights to request deletion or opt out of certain data uses, subject to coverage, verification, and legal exceptions. This guide explains direct requests and the CPPA's DROP platform, with links to the official sources.
Enforcement example: LocateSmarter (August 13, 2026)
On August 13, 2026, California reported that the California Privacy Protection Agency Board had issued a decision requiring LocateSmarter LLC, an Iowa-based data broker, to pay a fine and change its practices. The announcement describes this as the first action against a data broker under the CCPA and the first to arise under both the CCPA and the Delete Act; it says LocateSmarter failed to timely register and unlawfully required Californians to provide partial Social Security numbers before opting out. Read the California announcement alongside the CPPA's current DROP guidance, which says DROP allows California residents to submit a single deletion request to active data brokers and that brokers must begin processing these requests on August 1, 2026.
Your CCPA rights at a glance
Right to Know
Ask any data broker what personal information they hold about you and why they have it.
Right to Delete
A covered California consumer may request deletion, subject to verification, exceptions, and the business's response obligations.
Right to Opt Out of Sale
A covered California consumer may opt out of sale or sharing where the CCPA right applies, subject to scope and exceptions.
Right to Non-Discrimination
Covered businesses generally may not discriminate against a consumer for exercising applicable CCPA rights, subject to lawful exceptions.
The California DROP Platform: 2026 implementation
The Delete Act directs the California Privacy Protection Agency to operate an accessible deletion mechanism. The CPPA calls its consumer-facing application the Delete Request and Opt-Out Platform (DROP). The agency's official guidance and statutory text control if this summary differs from later implementation materials. consumer DROP guidance · broker guidance · current statutory text
How DROP works
How to send a direct CCPA deletion request
Even without DROP, a California resident may send a verifiable deletion request directly to a covered business. The template below is a practical starting point, not legal advice; check the recipient's current privacy-request instructions and keep a copy of what you send.
OfflistMe prepares a broker-specific version of this request, including the listed privacy contact. Read how to write a clear privacy-rights request →
CCPA vs other state privacy laws
Do not assume the CCPA applies outside California or that a broker will process every request under California law. Identify your location, the provider, the data involved, and the applicable statute before citing a right. The table is a high-level orientation, not a substitute for the current official law or agency guidance:
| State | Law | Deletion right | Effective |
|---|---|---|---|
| California | CCPA / CPRA | Yes | 2020 / 2023 |
| Virginia | VCDPA | Yes | 2023 |
| Colorado | CPA | Yes | 2023 |
| Connecticut | CTDPA | Yes | 2023 |
| Texas | TDPSA | Yes | 2024 |
| Florida | FDBPA | Limited | 2024 |
Full state-by-state guide: data removal rights by state (50 guides)
FAQ
Do I have to be a California resident to use CCPA opt-out rights?
The CCPA rights described here apply to California residents when the legal requirements are met. Other states may provide separate rights and response rules. Do not assume that citing the CCPA creates the same legal right for a non-California resident; identify the law that applies to you and check the broker's current privacy request process.
What is the California DROP platform?
The Delete Request and Opt-Out Platform (DROP) is a California Privacy Protection Agency system for a verifiable deletion request to data brokers within the Delete Act's covered scope. Check the CPPA's current consumer instructions and implementation updates; access cadence, verification, and exceptions are not the same as a guarantee that every downstream copy is deleted.
How long does a CCPA data deletion request take?
For a covered, verifiable California consumer request, the CCPA generally provides a 45-day response period, with a permitted extension in some circumstances when the consumer is notified. A response deadline is not a guarantee that every request will result in deletion; exemptions and verification requirements can apply. If the broker does not respond, document the request and consider following up or filing a complaint with the appropriate regulator.
What if a data broker ignores my CCPA deletion request?
Keep the request, verification correspondence, and any response. Send a written follow-up, then use the California Privacy Protection Agency complaint or enforcement channels when the issue falls within its jurisdiction. A complaint is an escalation option, not a guarantee of a particular outcome.
Related reading
Generate requests in under 60 seconds