We should be suspicious of any system in which companies profit from collecting personal information while individuals inherit the work of getting it removed.
That arrangement asks people to become unpaid administrators of their own surveillance. Find the companies. Understand the forms. Submit the requests. Check the results. Repeat when something changes.
California’s Delete Request and Opt-out Platform, known as DROP, offers a meaningful improvement. Eligible residents can use a free state service to send a deletion request to more than 600 registered data brokers. Mandatory processing began August 1, 2026. As of this September, the system has moved beyond collecting requests and into the period when brokers must act on them. [1]
That deserves recognition. Making a privacy right easier to exercise can determine whether it helps people in practice.
But a better way to request deletion should also prompt a harder question: why is so much responsibility placed on the person whose information is being traded?
The businesses covered by California’s data broker definition collect and sell personal information about consumers with whom they do not have a direct relationship. This distinction matters. A person may never have knowingly chosen to deal with the company holding their information. [2]
The burden should reflect that imbalance. A company choosing to build a business around other people’s information should carry the responsibility for explaining and justifying what it does with it. The public should not need a specialist’s understanding of advertising technology to exercise an ordinary preference for privacy.
DROP improves that balance by making a request persistent. California’s guidance says that, after initial processing, brokers must check for and delete new matching information at least every 45 days. Consumers may wait up to 90 days for processing status to appear. It is an ongoing obligation, rather than a request that becomes useless the next time information is acquired. [3]
That is the right design principle: a person’s decision should continue to count.
A refusal that must be endlessly renewed is a weak form of control. It rewards the organization that can afford to automate collection while exhausting the individual who has to manage objections manually.
There are limits to what DROP does. California’s guidance identifies exclusions, including certain exempt information, publicly available information, and information provided directly to a business. Matching also matters: a broker may be unable to locate a person’s record using the details supplied. A deletion request is therefore not a promise that every trace of someone disappears. [3]
These limits are a reason to describe the service accurately, and to keep asking what protections should come next.
At Patch the State, we believe deletion should sit alongside a more basic rule: collect only what a service reasonably needs, use it for a clearly defined purpose, and keep it for a justified period.
Consider the difference that would make. A business could still retain information needed to complete a transaction, prevent fraud, or meet a legal obligation. It would face a harder argument when retaining unrelated information indefinitely because it might become profitable later.
The distinction is practical. Every unnecessary record creates another thing to secure, another opportunity for misuse, and another piece of someone’s life that could escape their control.
Access matters, too. DROP is available to California residents. Its protection does not become available to every American simply because the brokers involved operate online. [1]
Our position is that a comparable, accessible way to refuse data brokerage should be available nationwide. State innovation can show what works, but people’s ability to resist commercial tracking should not depend on whether they happen to live within the right boundary.
Enforcement will determine how much the system delivers. Regulators should make compliance measurable and investigate failures. The public needs evidence that requests produce meaningful results, with clear explanations of exceptions and a workable way to challenge mistakes.
For eligible Californians, the official DROP website is a practical place to begin. For everyone else, it provides a concrete example of a demand worth making: one understandable request, continuing effect, and an obligation on companies to respond.
California has made exercising a privacy right easier. The broader goal should be a system in which protecting that right consumes far less of our lives.
Being left alone should not require an ongoing maintenance schedule.