The Deletion Clock Started
Since 1 August 2026, every data broker registered in California has been required to check the state's Delete Request and Opt-out Platform at least once every 45 days and process the deletion requests waiting there.
The platform is run by the California Privacy Protection Agency. It lets one verifiable request from a consumer direct every registered broker to delete that person's information, where the same result previously meant contacting brokers one at a time, indefinitely.
The first processing window closes 45 days after 1 August, which lands in the middle of September. Registration itself, carrying a $6,000 annual fee, closed at the end of January.
What the platform is for shows more clearly in an enforcement action from the start of the year. CalPrivacy announced on 8 January 2026 that Rickenbacher Data LLC, trading as Datamasters, would pay $45,000 and stop selling the personal information of Californians.
The agency documented that the company had bought and resold the names, addresses, phone numbers and email addresses of millions of people with Alzheimer's disease, drug addiction, bladder incontinence and other conditions.
The $45,000 was for failing to register as a data broker in 2024. It was not a penalty for assembling and selling the lists.
That is the part worth carrying out of the case. A list of people with a dementia diagnosis, sold to whoever will buy it, is a targeting file, and what enforcement reached was a registration form that had not been filed.
Which is why reducing what is available about a person is the lever that exists now, rather than the one that might exist after a case concludes.
The platform has edges worth knowing. It binds the brokers who registered, leaving the ones who did not to be found the way Datamasters was, and it is a California mechanism serving California residents. Deletion is not permanent either, since brokers rebuild from the sources they always used.
If this is your family
If your parent lives in California, sit down with them and submit a deletion request through the state's platform. It is one request instead of dozens and it takes a few minutes.
Wherever they live, put a reminder in the calendar to repeat whatever you do roughly twice a year. This is maintenance rather than a one-time fix, and most states have no central platform at all — elsewhere it means going to the largest brokers directly.
Sources
Delete Request and Opt-Out Platform (DROP) — California Privacy Protection Agency
CalPrivacy Brings New Round of Enforcement Actions Against Data Brokers — California Privacy Protection Agency, 8 January 2026