Californians block personal data from hundreds of brokers at once

from Colin Letcher and Miles HiltonCalMatters

This story was originally published by CalMatters. Sign up for their newsletters.

California’s Privacy Protection Agency has kicked off 2026 by releasing a tool state residents can use to get data brokers to delete and stop selling their personal information.

The system known as Request and Deny Deletion Platformor DROP, has been in the works for years, mandated by a 2023 law known as The erasure law. Under it and previous laws, data brokers must register with the state and allow consumers to tell the brokers to stop tracking them and selling their information.

Until now, these instructions had to be delivered to each data broker individually – no easy feat given that more than 500 brokers were registered in the state at the end of last year. Making things even more difficult, some brokers hid their opt-out forms from search results, as The Markup and CalMatters revealed in August.

The the new system provides privacy instructions to each registered broker at once. Launched on January 1, it is open to all California residents. By law, the hundreds of data brokers registered with the state must begin processing those requests in August.

Here’s how to take advantage of it.

Finding your advertising identifiers

DROP asks you to provide basic information – your name, email address, phone number and zip code – so that data brokers can find you in their systems. You can submit the form with just this information, but if you want a more thorough deletion, you can also provide your mobile advertising IDs from your phones, smart TVs and vehicles. Including these identifiers can help brokers match more of your data, but you need to take the time to collect them.

Click here to go ahead if you only want to provide basic information, or continue reading for instructions on providing mobile advertising IDs for:

Android phones and tablets
Apple iPhone and iPad
Vehicle identification numbers and smart TVs
Personal computers

Android phones and tablets

The steps below may differ slightly depending on your device and operating system version, but the general process is the same:

Open up Settings.
At the top of the settings screen, select the menu option with your name, followed by Google services and preferences.
Choose All services section.
Scroll to Privacy and security and select advertisements. Scroll to the bottom of this screen to get your Ad ID, which will look like a string of random numbers and letters separated by four dashes. Save this ID for the DROP form.

On the same screen you can find options for reset or delete your advertising ID. The CCPA offers reset your ID “because it breaks the persistent tracking link that advertisers, data brokers, and apps use to build long-term behavioral profiles of your device.” Alternatively, delete ID should prevent ID-based data tracking altogether.

Apple iPhone and iPad

Apple doesn’t provide a way for iOS users to see their Mobile Advertising ID, which they call an Advertiser ID, or IDFA. But it does provide a way for users to prevent trackers from accessing these identifiers.

To turn off tracking, first adjust your screen time settings:

Open up Settings.
Scroll down and select Screen time.
Scroll down and select Content and Privacy Restrictions.
Scroll down and select Allow apps to request tracking.
Choose Do not allow changes.

Next, adjust your tracking settings:

Open up Settings.
Scroll down and select Privacy and security.
Choose Tracking.
Switching OFF the option for Allow apps to request tracking.

Apple has its own ad system that does not use IDFA. To disable this:

Open up Settings.
Scroll down and select Privacy and security.
Scroll down and select Apple ad.
Switching OFF on Personalized ads option.

A quick note for our tech-savvy readers: If you’ve already turned off tracking, you may be tempted to turn it back on to look up your advertising ID using a third-party app, but you don’t have to. Re-enabling tracking will reset the ID, limiting its usefulness to data brokers — they can’t continue to track data or deliver personalized ads using a device ID that no longer exists.

Vehicle identification numbers and smart TVs

Vehicles can tracking their owners in surprisingly invasive ways, and you can provide a vehicle identification number or VIN in case the data brokers have that information. Where is your VIN will depend on the vehiclebut common locations include on the driver’s side dash or on a sticker in the front passenger door sill. Your vehicle registration documents must also include your VIN.

Smart TVs also use advertising identifiers. Here’s a guide which provides some settings for common brands. If the guide doesn’t cover your smart TV, try checking its privacy or advertising settings. But note that this is different from numbers like the model code and serial number.

Personal computers

Laptops and desktops use unique identifiers to share data, but they are harder to find than mobile advertising identifiers. Instead, you can turn off tracking, which will delete these identifiers. (Turning tracking back on will usually reset the IDs.)

On working computers Windowsyou can turn off your advertising ID by going to Settings. Depending on the version of your operating system, select Confidentiality or Privacy and security. Then choose generaland adjust your settings there.
On Mac computers, open System settings > Privacy and security > Apple ad. Then turn off Personalized ads.

The California Privacy Protection Agency also provides some of their own guidelines to find advertising identifiers.

Verify your identity

Go to DROP website. You will be asked to accept the terms of use and will be directed to a page that requires you to prove that you are a California resident. There are two ways to do this, and you can’t change the methods once you’ve chosen one of them.

The system allows you to verify your identity using personal information through a system called the California Identity Gateway.
If you choose this option, you will be asked to provide some basic personal information, such as a phone number, email address, California address, or your social security number. The gateway will use this information to try to verify your residency directly in the country. This option should be quick if you have an email address and phone number.
Alternatively, you can verify your DROP identity by using login.gov, a system that some federal and state agencies in the United States have adopted to allow residents to interact with government services.
To sign up for a login.gov account, you’ll be asked to provide an email address, create a password, and provide photo ID. Once you’ve registered and verified your identity, you should be able to proceed to the next step. This option may take a bit more effort than the first option since an ID is required, but it can be faster if you’ve already signed up for an account for other purposes.

Complete and submit the DROP form

Once you’ve verified your identity, you’ll be taken to a form where you can submit multiple versions of your name, up to three zip codes, up to three email addresses, up to three phone numbers, advertising IDs from your mobile devices and smart TVs, and VIN numbers for your vehicles. You will be asked to verify your email addresses and phone numbers with one-time use codes before submitting. (The agency notes that there may be delays with some verification codes due to high volume.)

After submitting the form, you will receive a unique DROP ID to check the status of your request.

what’s going on now

Sit and wait. Although the window for making DROP requests is open, state-registered data brokers are not yet required to process them. On August 1, brokers will begin processing requests.

Since then, companies have had 45 days to process the requests and 90 days to report how they handled the requests. If they don’t, companies can face financial penalties.

In the meantime, you can track the status of your request with your DROP ID. At some point later in the year, when you log in, the system should tell you whether your data has been successfully deleted, whether records for you have not been found, or whether companies believe the data is exempt from deletion under the law, which provides some limited ways for brokers to retain data.

If you find more information while you’re waiting for your request to be processed, such as a new Mobile Advertising ID, you can update your request with that information, increasing the chances of successfully deleting your data.

This article was originally published on CalMatters and is republished under Creative Commons Attribution-NonCommercial-No Derivatives license.