CCPA Data Broker Opt-Out Guide 2026: Use California Law to Remove Your Data

California privacy law gives every consumer — not just California residents in practice — the right to demand data brokers delete their personal information. Here is how to exercise that right, including the new DROP platform that went live in January 2026.

Updated: May 202615 min readBy OfflistMe Privacy Team

New in 2026: California's DROP platform launched January 1, 2026. Starting August 1, 2026, registered data brokers must process DROP requests every 45 days. This is the most significant change to consumer data rights in years.

Your CCPA rights at a glance

Right to Know

Ask any data broker what personal information they hold about you and why they have it.

Right to Delete

Request that a data broker delete your personal information. They have 45 days to comply.

Right to Opt Out of Sale

Tell data brokers not to sell or share your personal information with third parties.

Right to Non-Discrimination

Brokers cannot deny you services or charge you more for exercising your CCPA rights.

The California DROP Platform (January 2026)

The California Delete Act (AB 1362, signed 2023) created a new tool: the Data Removal Opt-Out Platform (DROP), operated by the California Privacy Protection Agency. It launched January 1, 2026.

How DROP works

Step 1.Visit the California Privacy Protection Agency portal at cppa.ca.gov (no account required for submission).

Step 2.Submit your identity information (name, date of birth, email, address). The CPPA uses this to match records, not to sell or share.

Step 3.Your deletion request is forwarded to all registered data brokers simultaneously.

Step 4.Starting August 1, 2026: registered brokers must process DROP requests every 45 days. Non-registered brokers are not covered.

Limitation: DROP only covers brokers registered with the CPPA. Hundreds of smaller brokers are not registered and will not respond to DROP requests. For full coverage, you still need individual opt-out requests — or use the OfflistMe opt-out generator.

How to send a direct CCPA deletion request

Even without DROP, you can send CCPA deletion requests directly to any data broker. Here is the required structure. The more specific the legal citation, the faster brokers respond.

Subject: CCPA Deletion Request — [Your Full Name] To Whom It May Concern, Pursuant to the California Consumer Privacy Act (Cal. Civ. Code §1798.105), I hereby request that you delete all personal information you hold about me. Full Name: [Your Full Name] Current Address: [Your Address] Previous Addresses: [Any you know about] Date of Birth: [Your DOB] Email Addresses: [All your emails] Please confirm deletion within 45 days as required by California law. Failure to comply may be reported to the California Privacy Protection Agency (cppa.ca.gov), which may impose civil penalties of $2,500–$7,500 per violation. [Your Name]

OfflistMe generates a correctly-formatted version of this request for each broker, including their specific privacy email address. Read more about what makes an opt-out legally binding →

CCPA vs other state privacy laws

Most brokers honor CCPA requests regardless of your state because California has the strictest law and brokers cannot verify state residency at scale. But if you want to cite your own state's law, here is the landscape:

State	Law	Deletion right	Effective
California	CCPA / CPRA	Yes	2020 / 2023
Virginia	VCDPA	Yes	2023
Colorado	CPA	Yes	2023
Connecticut	CTDPA	Yes	2023
Texas	TDPSA	Yes	2024
Florida	FDBPA	Limited	2024

Full state-by-state guide: data removal rights by state (30 guides)

FAQ

Do I have to be a California resident to use CCPA opt-out rights?

Technically, CCPA applies to California residents. However, most large data brokers honor CCPA deletion requests from all US residents because they cannot easily verify state residency and the legal risk of refusing is high. For non-California residents, cite CCPA in your request — most brokers will process it.

What is the California DROP platform?

The Data Removal Opt-out Platform (DROP) is a free tool launched by the California Privacy Protection Agency (CPPA) on January 1, 2026. It lets California consumers submit a single deletion request that is forwarded to all registered data brokers simultaneously. As of August 1, 2026, registered brokers must process DROP requests every 45 days.

How long does a CCPA data deletion request take?

Under CCPA, businesses have 45 days to respond to a deletion request, with a possible 45-day extension (90 days total). Most data brokers process requests within 7–30 days. If a broker does not respond within 45 days, you can file a complaint with the California Privacy Protection Agency.

What if a data broker ignores my CCPA deletion request?

File a complaint with the California Privacy Protection Agency at cppa.ca.gov. CCPA enforcement actions carry fines of $2,500 per unintentional violation and $7,500 per intentional violation. Citing this penalty range in your follow-up request often prompts faster compliance.

Generate CCPA-compliant opt-out emails instantly

OfflistMe generates properly-worded CCPA deletion requests for 300+ brokers. You send them from your own inbox — no account, no ID, one-time $5.

Start with 3 brokers free →