You asked data brokers to delete you. Weeks later the status screen reads EXEMPT for one, RECORD NOT FOUND for another and nothing for a third. Which of those is a refusal? Under California DROP, the state's single deletion portal for brokers, perhaps only the blank one, because the first two are answers the law allows.
DROP does force registered brokers to delete you, but it cannot reach companies you deal with, and some replies are lawful non-deletions.
- Only California residents can file, and only brokers with no direct relationship to you are covered.
- EXEMPT and RECORD NOT FOUND are lawful replies; a blank status after the first reporting window is the red flag.
- List every email and phone number you use, because brokers match only identifiers they already hold.
- Until independent audits begin, your own rechecks are the enforcement.
Does California DROP Actually Delete Your Data?
Yes, where a registered broker holds a matching record, DROP orders deletion, inferences included, but the broker may keep the minimum personal information needed to comply, and exempt records stay put.
The Delete Request and Opt-out Platform opened to California residents in January 2026. Brokers had to start processing requests on 1 August 2026 and must check in at least every 45 days, per CalPrivacy. Count 45 days from 1 August and you reach 15 September: my arithmetic, not an announcement, but it means a status should already be in your account.
What comes back is a status code, and the codes are the fine print. CalPrivacy's testimony to the Vermont Senate (slides as of 1 May 2026) says brokers may keep the minimum personal information needed to comply. EXEMPT means the record falls under a legal exemption, OPTED-OUT means every identifier you shared was already opted out, and RECORD NOT FOUND means nothing matched. None is a refusal.
Matching runs on hashed identifiers, and a broker downloads only the identifier types it already holds. One that knows you by phone number alone will not find you if you submitted just an email, so it will honestly answer RECORD NOT FOUND. Guides saying one email is enough are wrong: list every address and number you use.
DROP covers only data brokers, meaning businesses that sell data on people they have no direct relationship with. Your bank and the shops you buy from keep their records. Headline rules often shrink on contact: compare the vacated FTC click-to-cancel rule with what the FTC junk-fee rule actually covers.
Four figures decide how much leverage you hold, all from CalPrivacy's own pages and testimony: how long you wait, and what a stalling broker risks.
Status reporting window
45 days
Silence after this, chase
Annual broker registration fee
$6,000
Small next to daily penalties
Registration enforcement actions
Nearly a dozen
Deletion cases still untested
Penalty per undeleted request
$200 a day
Clock runs per request
The penalty matters mostly as a comparison. Charged per request and per day, it overtakes a broker's yearly registration cost in about a month of ignoring one request. That break-even is my arithmetic from two published numbers.
Thirty days of ignoring one request costs a broker as much as a year of registration. That is the leverage. Whether the agency will use it on deletions is still untested.
What Do Brokers Keep, Row By Row?
Brokers may keep the minimum records needed to comply and anything covered by an exemption, and companies outside DROP's scope keep everything, so the table sets each rule against your next move.
Each middle cell pits what DROP makes a broker do against what it may keep.
| Dimension | Must delete vs may keep | What it means for you |
|---|---|---|
| ๐ฐ Your cost | Brokers pay $6,000 a year You see no fee listed |
✅ No charge to you is listed |
| ⏱ Status clock | Brokers report within 45 days You see updates from Aug 2026 |
⚠️ Blank since mid-September? Chase it |
| ๐งพ Replies | Deleted data and inferences 3 replies that are not refusals |
⚠️ Only a blank or stale status is a problem |
| ๐ Who is covered | Covered brokers with no tie to you Kept by your bank or employer |
❌ Everyday accounts stay untouched |
| ๐ Matching | Found via hashed email or phone Missed if you left one out |
⚠️ List every email and number you use |
| ⚖️ Penalties | Late deletion: $200 a day each Audits start 1 Jan 2028 |
⚠️ Until then, you are the auditor |
| ๐ Best suited for | Fits a Californian with many brokers Skip if you live elsewhere |
๐ File once, recheck every cycle |
My reading: the platform is a good lever and a poor guarantee. It is strong where a broker holds a match and silent everywhere else.
The decision this settles is how often to recheck: once per cycle, about eight times a year, not once and forget. The arithmetic is derived: 365 days divided by 45, and the daily penalty over one cycle gives up to $9,000 per ignored request.
What Can Go Wrong With A Data Broker Deletion Request?
Most failures come from who you are and what you listed: outside California the platform does nothing for you, and a broker holding an identifier you never submitted will answer RECORD NOT FOUND.
Residency is the hard wall, so look to your own state's rules if you live elsewhere. Then comes the evidence gap. CalPrivacy's February 2026 product-update deck leaves sign-ups, verified-resident share, completion time and support tickets blank, and the May testimony slide does the same. So no official success rate exists; anyone quoting one is estimating. Untested rights are not new: see airline refund rules after the 2025 rollback.
CalPrivacy told Vermont senators in May 2026 about nearly a dozen actions for failing to register, with no names or amounts, which suggests deletion enforcement is untested. So I would not assume a broker fears the daily penalty (a guess, and a fair one, but still a guess). Independent audits are not required until 1 January 2028, so for two years your own checks are the audit.
- A blank status after the first window deserves a written follow-up, not a shrug.
- RECORD NOT FOUND on a broker that holds only your phone number means you left an identifier out.
- EXEMPT is lawful, but ask which exemption the broker relies on.
Key takeaways to act on: which of these is true for you?
- You live in California and your status screen is still blank.
- A broker holding only your phone number shows RECORD NOT FOUND, and you filed with just an email.
- The company is one you deal with directly, such as your bank, so DROP will not reach it.
- Your last status check is over 45 days old.
Here is the decision. If you live in California, file once with every email address and phone number you use, then check the status screen every 45 days and chase any blank. Elsewhere, DROP is not for you. If your fight is a rejected health claim in India, start with this guide to pushing back.