California Launches Tool to Let Residents Erase Data Broker Records in One Click

A New Digital Right Takes Effect

Starting this month, millions of Californians can now use a state-run online portal to order hundreds of data brokers to erase their personal information at once. The tool, called the Delete Your Data registry, fulfills a mandate under the California Delete Your Data Act (SB 362), which was signed into law in 2023 and took full effect in 2025. The California Privacy Protection Agency (CPPA), which built and maintains the website, says the portal is the first of its kind in the United States.

The move turns what was once a tedious, privacy-risky chore into a few clicks. Previously, a consumer who wanted to opt out of data collection had to visit each broker's website individually, submit separate requests, and track responses manually. Now, a single form on the CPPA website sends deletion requests to every business registered as a data broker under California law. The state then monitors compliance, with the power to investigate and fine companies that ignore or delay the requests.

"This is a game-changer for consumer privacy," said Jennifer Whitfield, a senior policy analyst at the Center for Digital Rights, a nonprofit that advocated for the law. "It moves from a patchwork of opaque individual procedures to a centralized, enforceable system. Californians no longer need to be privacy experts to protect themselves."

How the Delete Your Data Portal Works

The portal is open to any California resident age 18 or older. To start, a user visits the CPPA website, verifies their identity through a secure process that may include email or SMS confirmation, and submits a request. The system then instantly sends notifications to every data broker currently listed on the California Data Broker Registry — a database of over 400 companies that collect and sell personal information, as required by SB 362.

Once notified, each broker has 30 to 45 business days to delete the consumer's data from its systems, including any data held by third-party subsidiaries, and must then send a confirmation notice to the consumer. The CPPA enforces deadlines and can impose civil penalties of up to $10,000 per violation per day, along with injunctive relief.

Crucially, the request does not opt the consumer out of future data collection. If a broker gathers the same information again later, the deletion request does not prevent that new collection — a limit that privacy experts say is a gap. "The law is retroactive, not prospective," explained Marcus Delgado, a law professor at Stanford specializing in information privacy. "It forces deletion of what the broker already has, but it doesn't stop them from re-collecting it tomorrow unless the consumer also opts out of sale or sharing through other mechanisms."

Why Data Brokers Are Targeted

Data brokers are companies that collect personal information from public records, purchase histories, mobile apps, and other sources, then sell or share it with advertisers, insurers, employers, and even law enforcement. These firms often operate invisibly, outside the direct consumer relationship, and individuals rarely know what data is held about them or where it goes.

The California registry lists a broad range of businesses, from well-known identity-theft protection firms to obscure people-search websites. Each broker is required to disclose its contact information, data collection practices, and how to opt out. The new portal builds on that registry, making it actionable.

"Data brokers have enjoyed a Wild West environment for decades," said Whitfield. "They know everything — your age, income, health interests, political leanings, even your friends and relatives. Now California says that unless you give them permission to keep it, they must erase it when asked."

California's action is part of a broader global trend. The European Union's General Data Protection Regulation (GDPR) has long granted deletion rights, and states like Virginia, Colorado, and Connecticut have passed similar laws, though none has yet built a single-portal enforcement system. California's registry approach is being closely watched as a model for other states.

The Compliance Challenge for Businesses

For data brokers, the new system imposes a significant operational burden. Each request must be verified, fulfilled, and documented in a way that can withstand regulatory audit. Smaller companies, in particular, may struggle with the technical requirements of locating and erasing data scattered across cloud servers, backup tapes, and legacy databases.

"It's a massive under-taking," said Eric Marshall, a privacy compliance consultant at Thistle Consulting Group. "Many brokers have never had to build a true deletion pipeline. They are used to collecting and selling, not forgetting. We're seeing firms scrambling to hire data-mapping experts and purchase data-erasure software."

The CPPA has attempted to ease the transition by providing guidance and a 90-day grace period for first-time compliance, but the agency has also made it clear that it will not hesitate to fine repeat offenders. In a statement, CPPA Executive Director Emma Barreau said, "The law is clear. Californians have the right to delete their data, and we will hold any broker that violates that right accountable to the fullest extent."

Some critics argue the law places an unfairly heavy burden on legitimate businesses that use data responsibly. "Not all data brokers are nefarious," said Marshall. "Many provide useful services, like fraud detection or credit reporting. The law treats them all the same, even though the data they hold serves different purposes." The law does allow brokers to deny deletion requests in limited circumstances, such as when retention is required for security, fraud prevention, or legal compliance — but those exceptions must be proven by the broker.

What California Residents Should Do — and What to Expect

If you live in California and want to delete your data, the process is straightforward. First, go to the CPPA website and locate the Delete Your Data section. You'll need to provide your name, email address, and a copy of identification or proof of residency if requested. After submitting the form, you should receive a confirmation email with a tracking number. The CPPA recommends that residents check their email regularly, as brokers must send updates on the status of your request.

You may need to re-submit requests periodically, especially if you continue to use the internet, shop, or engage with services that share information. "This is not a one-time fix," Delgado warned. "Your data will re-accumulate. A Privacy Lifestyler might use the portal every few months."

Experts also recommend that residents, after submitting the deletion request, separately exercise other rights available under the California Consumer Privacy Act (CCPA), such as opting out of the sale of their data or limiting the use of sensitive personal information. The deletion portal is designed to work alongside those existing protections.

The Future of Data Deletion

California's launch is expected to accelerate similar efforts nationwide. At least a dozen states are considering legislation modeled on SB 362, according to the National Conference of State Legislatures. Some advocates are pushing for a federal data privacy law that would create a single national deletion portal, though progress in Washington remains slow.

The data broker industry, meanwhile, is adapting. Major data aggregators have begun building "consumer request portal" APIs that can automatically process bulk deletion mandates, reducing the manual burden. Industry groups argue that a standardized national framework would be more efficient than a patchwork of state rules.

Whitfield believes that California's move will eventually change the fundamental economics of the data trade. "Once people can easily delete their data, brokers lose some of their inventory. That forces them to find better, more transparent ways to earn trust. We might see a future where data brokers actually offer consumers a direct share of the profits from their data, rather than hiding in the shadows."

For now, residents of the Golden State have a powerful, easy tool to take control. The deletion portal is open, and the clock is ticking for data brokers — in California, privacy is no longer a privilege for the tech-savvy, but a right available to everyone.