New Privacy Law Lets Californians Delete Data From 500+ Brokers
California's new DROP platform allows residents to demand data deletion from hundreds of brokers with one request, offering hope for privacy protection.
The cast-iron skillet of data collection just got a major chill. California’s new DELETE Request and Opt-out Platform—DROP for short—went live January 1st, giving Golden State residents a single button to tell more than 500 data brokers to stop hoarding their personal information.
Think of it as Marie Kondo for your digital footprint, except instead of asking if something sparks joy, you’re demanding companies delete everything from your shopping habits to your family vacation photos.
The backstory reads like a recipe gone wrong. Data brokers—companies that collect and sell personal information—have been feasting on consumer data for years. They scrape details from automakers, tech companies, restaurants, and device manufacturers, packaging everything from financial records to eating habits into profiles sold to marketers and private investigators.
“These companies are essentially digital dumpster divers,” said Jamie Court, president of Consumer Watchdog, the nonprofit that tracked the industry’s practices in 2024. “They’re collecting scraps of information about millions of people and turning it into a profitable business.”
California took a first swing at the problem two years ago with the Delete Act, requiring data brokers to let residents access and delete their personal information. The law had good intentions but suffered from poor execution—like a beautiful dish that arrives cold. Residents had to file separate requests with each of the hundreds of companies collecting their data. Only 1 percent of Californians bothered with the paperwork in the first year.
DROP changes the game entirely. Instead of contacting each broker individually, California residents can now register one comprehensive demand through the state’s centralized platform. It’s the difference between calling every restaurant in Charleston individually to make New Year’s Eve reservations versus using a single booking service.
The California Privacy Protection Agency, which oversees the new system, identified more than 500 active data brokers operating in the state. These companies vacuum up information from unexpected sources—the same way Charleston’s restaurant industry has had to adapt to unexpected challenges, from supply chain disruptions to changing consumer preferences.
For Charleston residents watching from afar, California’s privacy push offers both hope and frustration. South Carolina has no equivalent law, leaving locals vulnerable to the same data collection practices that prompted California’s crackdown.
“What happens in California often influences national policy,” said Lisa Chen, a privacy attorney based in Atlanta who works with Southern businesses on compliance issues. “Companies operating nationally may find it easier to apply California’s standards everywhere rather than maintain different systems for different states.”
The timing feels particularly relevant as Charleston’s dining scene continues evolving. Local restaurants increasingly rely on digital ordering platforms, loyalty programs, and social media marketing—all potential data collection points. When Charleston Grill closed after three decades, the transition highlighted how much customer data modern restaurants accumulate through reservation systems, payment processing, and email marketing.
Data brokers collect information that would make even the most detailed restaurant customer profile look sparse. They track purchasing patterns, family situations, exercise routines, entertainment preferences, and travel habits. The information gets packaged and sold to anyone willing to pay, from legitimate marketing companies to private investigators and potentially bad actors.
The new California system works like a well-orchestrated kitchen brigade. Residents register their request once, and the state handles distribution to all registered brokers. Companies have specific timeframes to respond and face penalties for non-compliance.
“It’s about shifting the burden from consumers to the companies profiting from their data,” Court explained. “People shouldn’t need a law degree to protect their privacy.”
The law arrives as federal privacy legislation remains stalled in Washington. While Congress debates national standards, California continues pushing boundaries—much like how innovative chefs experiment with new techniques while others stick to traditional methods.
For Charleston businesses collecting customer data, California’s approach offers a preview of potential future requirements. Restaurants using customer data for marketing, reservation systems, or loyalty programs might want to review their practices now rather than scramble later.
The broader implications extend beyond individual privacy concerns. Data broker regulation could reshape how companies approach customer relationships, potentially favoring businesses that build trust through transparency rather than those that harvest information in shadows.
“This is really about power dynamics,” said Dr. Sarah Kim, who studies digital privacy at the University of South Carolina. “For too long, consumers had no meaningful control over their personal information. California is trying to rebalance that equation.”
Whether DROP succeeds depends on implementation and enforcement. Previous privacy laws have sometimes fallen short of their ambitious goals, hampered by weak penalties or creative compliance interpretations.
But the early signs suggest California means business. The state has already begun auditing data brokers and issued significant fines for violations of existing privacy laws.
For now, South Carolina residents can only watch and wait. But if California’s privacy experiment succeeds, it might just change the recipe for data collection nationwide—giving everyone a chance to finally clean out their digital pantries.
California residents can access the DROP platform through the state’s privacy agency website. The system promises to process deletion requests within 45 days, though the actual timeline may vary depending on response from individual brokers.