Understanding DROP: California's New Platform for Consumer Data Deletion

California has introduced a privacy mechanism that could reshape how consumers exercise their data-deletion rights and how marketers assess the durability of third-party audience data. The Delete Request and Opt-Out Platform, known as DROP, is a state-run tool designed to make it easier for California residents to request the deletion of personal information held by registered data brokers. Beginning August 1, 2026, registered data brokers will be required to check DROP at least every 45 days and comply with eligible deletion requests submitted through the platform.

For consumers, DROP aims to reduce the friction of having to ask multiple companies to delete personal information. For marketers, the implications are more complex. As deletion requests become easier to submit and harder for data brokers to overlook, brands will need to understand where their media strategies rely on brokered third-party data, how much exposure their California-targeted campaigns have, and what alternatives are ready to support audience strategies as privacy-driven signal loss accelerates.

How California’s DROP Works

Before DROP, a California resident who wanted to delete their data from data brokers had to find each one individually and submit separate requests. This was a tedious process, so relatively few residents completed it. By reducing the process to a single click on a single platform, DROP eliminates that earlier friction almost entirely.

A consumer visits a state-run website, verifies their California residency, enters their name, email, phone number, and optionally their mobile advertising ID, and with one click sends a legally binding deletion request to every registered data broker simultaneously.

There are currently 566 registered brokers on the platform—including recognizable names like Experian, Equifax, Acxiom, LiveRamp, ZoomInfo, Oracle, and Epsilon—and as of late March 2026, consumers had already submitted over 255,000 deletion requests, with projections of 500,000 to 1 million by August.

Once the August 1 compliance deadline takes effect, registered data brokers must regularly check the deletion list, match consumer records against it, and delete eligible data. Importantly, that requirement includes behavioral inferences drawn from the data, including assumptions based on browsing history, location data, purchase behavior, or other signals that may indicate life stage, interests, or purchase intent. The penalty for non-compliance is $200 per consumer, per day, with no warning period.

Why Programmatic Advertising Will See the Biggest Impact 

The impact of DROP is not uniform across advertising channels. The law includes a critical carve-out for businesses with a "direct relationship" with the consumer, which creates distinct zones of exposure for media buying.

Walled gardens will remain protected. Channels like Google and Meta are largely insulated. Consumers knowingly create accounts and interact directly with these platforms, which satisfies the direct relationship test.

Campaigns running through walled gardens face minimal exposure to DROP signal loss. Contextual targeting doesn't depend on individual consumer profiles, so the tactic will likely become even more valuable. The shift toward page-level context and sentiment-based targeting is already underway in programmatic strategy and will only gain urgency under DROP.

Third-party data ecosystem bears the brunt. The impact of DROP will be most concentrated in the secondary data market, which includes independent DSPs, third-party audience segment providers, and adtech firms that collect data via SDKs and pixels embedded in other companies' properties. 

Note, the impact of mobile advertising IDs (MAIDs) opt-outs deserves particular attention. MAIDs are largely considered the connective tissue of mobile behavioral targeting, but if a consumer includes their MAID in their DROP request, every broker matching on that identifier must delete the associated record and all inferences built from it. Depending on the approach, any campaign relying on audience data from third-party data ecosystems will experience direct additional signal loss once DROP takes effect. 

Anticipating DROP Adoption Rates

Predicting how many residents will use DROP remains difficult, but early indicators suggest broader adoption than initially anticipated. There have already been 255,000 requests in under three months, with projections reaching 500,000 to 1 million by August, thanks in part to a public-awareness campaign run by CalPrivacy. A relevant lesson from the App Tracking Transparency rollout is that opt-out rates were high initially, then grew as opting out became habitual. DROP adoption will likely follow a similar pattern, growing steadily rather than plateauing after an initial burst from privacy-conscious early adopters.

One friction point worth noting involves matching accuracy. The system works by comparing hashed identifiers. If a consumer submits with a nickname, an outdated ZIP code, or without a MAID, brokers may return a "record not found" status. Early match rates will be imperfect but should improve as consumers become more familiar with the process. While California is the first state to roll out this type of comprehensive deletion platform, others will follow. Similar legislation is already active or filed in Connecticut, Illinois, New York, Rhode Island, Nebraska, and Vermont as of April 2026. How marketing strategies adapt to DROP will inform operations in every subsequent market.

Strategic Considerations for Advertisers

Marketing organizations should begin evaluating their exposure across several dimensions:

Audit Current Exposure: Review media plans to identify spending that relies on independent DSPs or third-party audience data targeting California consumers. Quantifying this exposure provides a baseline for understanding potential impact.

Assess Partner Readiness: Key DSP and data partners should be able to articulate their DROP integration plans and provide guidance, specifically on the suppression list infrastructure and the expected impact on match rates.

Start Shifting Testing Budgets: Test budgets should shift toward first-party data activation and audience segmentation strategies that don't rely on high-risk third-party sources. 

Continue Developing Contextual Capabilities: For California-targeted campaigns in exposed categories, contextual and sentiment-based targeting represents the most durable alternative. Building these capabilities now will provide a true competitive advantage. 

Monitor Impact: Establishing regular tracking of signal loss in California-targeted programmatic campaigns beginning August 1 will be critical, providing early indicators of real-world adoption rates and impact, knowing that other states across the U.S. are considering similar systems for their residents. 

Final Thoughts

DROP represents the most significant change to the third-party data ecosystem since Apple's App Tracking Transparency rollout in 2021. Unlike previous privacy mechanisms that required consumers to navigate complex opt-out processes, DROP streamlines deletion to identity verification and a single action. This reduction in friction fundamentally alters the dynamics of adoption for privacy tools.

The implications extend beyond California's borders. As similar legislation advances in other states, marketing strategies will need to account for a coordinated deletion system across much of the country. The data that powers much of digital advertising remains in a period of sustained volatility that first began with the EU’s General Data Protection Regulation (GDPR).

Organizations that begin adapting now to reduced third-party data availability will establish true competitive advantages over those that delay adaptation. While DROP takes effect on August 1, the legislation is just the latest in a series of broader shifts underway as privacy frameworks mature and consumer demand—and adoption—for privacy-first advertising accelerate across markets.