I have only one phone number and have had it for a really long time. It’s my cell number, my home number, and my business number.
When relaunching L.A. TACO in 2018, I used that number on every business expense we needed, from funding to products to services. When we went through some financial stress in 2024, it was the number tied to the predatory loans we took to stay afloat.
Today, I get dozens of spam calls and texts every single day. No doubt many people out there can relate to this and are probably as annoyed and frustrated as I am. There doesn’t seem to be a real solution for this, but a new statewide program was just launched to help, at least a little.
On August 1, more than 600 companies registered with the State of California as data brokers became legally required to erase the personal information of any California resident who asked them to. About 300,000 people already have, including me.
The tool is called DROP, short for the “Delete Request and Opt-out Platform.” You’ll find it at privacy.ca.gov. It’s run by the California Privacy Protection Agency and it's free.
You simply fill out a single form, and it goes to every registered broker in the state at once. No other state government, as far as I can find, has built one.
What’s a Data Broker?
A data broker is a company that collects and sells information about you that you never knowingly gave it. The definition under California law is: a business that collects and sells personal information about a consumer with whom it has no direct relationship.
They buy from the businesses you do deal with, then package and resell your information and data.
In L.A., there's a more immediate buyer, and yes it goes back to the feds. Federal immigration enforcement actively uses data brokers. LexisNexis, through its Accurint platform, builds dossiers from more than 10,000 sources and sells access to ICE and CBP under a contract worth up to $22.1 million. More than 11,000 ICE agents have access to this database.
In the first seven months of one contract, agents ran over 1.2 million searches. ICE has said in its own contracting documents that it works with LexisNexis partly because a growing number of local governments won't share information about foreign-born people in custody.
ICE has said in its own contracting documents that it works with LexisNexis partly because a growing number of local governments won't share information about foreign-born people in custody.
How This Was Built In the Golden State
California has been chipping away at data brokers for about eight years.
The California Consumer Privacy Act set the ball rolling in 2018. Then in 2019, AB 1202 created the country's first data broker registry, run out of the Attorney General's office.
Then, State Senator Josh Becker of Menlo Park introduced SB 362, also known as the “Delete Act,” in April 2023.
"Rights that are too complicated to use are not really rights," he told Digiday that summer.
The ad industry fought all of this with ferocity, and lost. Gov. Newsom signed it on October 10, 2023.
A few years later, the website launched. And all things considered, it's a pretty high-quality site.
Delete Yourself
To get this process started, you only need three things: your name, your date of birth, and your ZIP code.
First, you confirm California residency, either by entering basic information through the state's identity gateway or by signing in with Login.gov. You don't have to create an account, and DROP doesn't keep the residency information.
You can also file for someone else, like a parent or a kid. I definitely found it easier to first set up my account on Login.gov and then go back to DROP. They say Login.gov has other uses as well, but I haven't looked too deeply into it yet.
Once you’re set up on DROP, you build a profile. It's literally a one-page form. Before you do that, you’ll need to confirm either an email or a phone. I had trouble confirming my phone (never got the text message despite repeated tries from two different devices), but the email worked on the first try, so I'd recommend using email rather than phone if possible.
Past those required three fields, you can add additional email addresses, phone numbers, maiden names, your mobile advertising ID (MAID), your connected TV ID, and your car's VIN. All of those are optional, and you can come back and add more later.
If you use an iPhone and want to get your mobile advertising/MAID ID, there’s an app called My Device ID by AppsFlyer. For Android, open your device Settings, tap Google, and select Ads under services.
Unlike some other state-run websites, this one is slick, it works, and it doesn't have a lot of weird UX decisions.
After submitting your info, you just save the DROP ID on the confirmation screen. That's how you check the status of your request later to see what’s been done on your behalf.
Brokers have to check DROP at least every 45 days and report back within 45 days of pulling your request. So give it three months before you panic.
Five statuses come back. “Deleted” means done. “Exempted” means they can keep everything they have on you. “Opted-out” means they couldn't match you but can no longer sell your information. “Record not found” means they don't have you, or can't find you, in their systems. “Pending” means they haven't gotten to it yet. Brokers have to check DROP at least every 45 days and report back within 45 days of pulling your request. So give it three months before you panic.
Why All Of This May Not Actually Work
The weak point here is that the exemptions are large. Brokers can keep public records: property ownership, vehicle records, voter registration. They can keep data tied to a criminal or civil investigation. They can keep anything covered by HIPAA, the Fair Credit Reporting Act, or Gramm-Leach-Bliley. Public records and credit-adjacent files are what the law enforcement products, like those helping ICE, are built on.
Anything you have given a company directly stays with that company. And let’s be honest, we’re giving almost everything to the big dogs. Meta, Google, and every app that collects your info are mostly outside the law, because they aren't brokers under the definition.
If a broker can't make a clean match, you get "opted-out" instead of "deleted." They still have your file. They just can't sell it . . . for now.
So Is It Worth Doing?
Yes. It took me 5 minutes total, and even if I get just a few less spam calls and texts, I’ll be thrilled. Unlike some of the other state websites, this one is built really well and at the very least, made me feel like I was doing something.
Getting the same result on your own would mean hundreds of separate requests, assuming you could find out which companies hold your file in the first place.
Even if DROP is not perfect, I applaud the state for actually doing something to help its citizens. Is there some dark reason they’re doing this? I can’t find one.
One day after I signed up, I found that I’d already been deleted from 7 data brokers, including Telesign Corporation and Gather Analytics, LLC. I’m hoping to see that number grow and grow in the coming days and weeks, and the number of spam emails, texts, and calls I get reduce in kind.
One smart thing about this program is your request covers every broker that registers in the future, not just the ones on the list today.
