Why California's data broker registry matters more than its delete button

Most of the coverage around California’s Delete Request and Opt-Out Platform has been centered on the one thing you would expect to be covered: Californians can submit one request to remove all of their personal info from the databases of registered data brokers. The real story here, though, is hidden in plain sight.

DROP is a tool for disclosure rather than for removal. As a result, there are substantial differences in the responsibilities of those charged with protecting people, organizations, or sensitive operations.

The Problem DROP Actually Solves

For years, we have been operating under the assumption that people can control their data exposure. Fill out one form to make your request, check off another box to opt out, etc. In theory, this system should be efficient; in actuality, few people have that much time.

Most people don’t know how many companies hold their personal information. Most people do not know who is selling their personal information, who is buying it, or where and when it will spread once it enters the brokerage market. Professionals, even those familiar with the issue, still encounter the same barrier: managing personal data is an insurmountable task for any individual.

DROP recognizes this reality. Rather than pretending that personal responsibility can be scaled to match the vastness of today’s data collection, California created something central to the issue: a centralized database (registry) with a single mechanism for submitting requests and a requirement for disclosure of data held by all companies collecting such data. It is not a perfect solution. However, it is an honest reflection of the issue's true nature.

What the Registry Actually Reveals

The Public Data Broker Registry makes DROP much more interesting. To participate in DROP, data brokers must report whether they collect data from minors, collect geolocation data, or process data from sensitive areas (e.g., reproductive health). These are not abstract categories. They are the kinds of data most closely tied to real harm.

Think about what this means for all those working in security or protective roles. Geolocation data could potentially create maps of an individual's movements. Data on children could potentially be used by predators to target them. Healthcare data could potentially be used as a weapon in ways that most people cannot even imagine.

The registry doesn’t capture every broker. It can’t. However, it will do something that has been missing to date: create a state-based disclosure record. This will provide regulators with something tangible to evaluate. It provides individuals with a better understanding of their own level of exposure. And it removes the ability for data brokers to claim compliance with a privacy policy while using generic terms.

For all of us who work on evaluating risks, that type of visibility is helpful.

Where the Limits Show Up

The removal of data does not solve the problem of data brokers; they continue to gather data (newly purchased), process data (data from third parties) and update consumer records on a continuous basis. Deletion requests delete data based on the date and time you made the request. It does not change how the data can be repurchased and appear again in your profile 30 days later.

The enforcement timeline represents this disconnect. Data brokers have 45 days to complete their deletion obligations; audits typically happen over multi-year cycles. When compared to the almost real-time collection by data brokers, these enforcement periods are nothing but a formality and do little to protect consumers.

The DROP regulation applies only to entities within California's jurisdiction, which presents another issue. Offshore data brokers, business entities subject to other regulatory schemes and businesses that collect data directly from consumers may not fall under the jurisdiction of the DROP regulation. As previously stated, these are not the result of oversight; these are simply the expected limitations of a state-wide regulation.

What This Means for Protection Professionals

If your job involves protecting people, whether that's executives, public figures, or organizations with sensitive operations, DROP offers a useful tool but not a solution.

Centralized deletion requests can reduce some exposure. The registry can help identify which brokers are holding what kinds of data. Both of these are worth using.

But the structural problem remains. Data ecosystems are persistent and adaptive. Regulation is episodic and bounded. That gap can't be closed through legislation alone.

What DROP signals is a shift in how regulators are thinking about the problem. Less emphasis on abstract rights. More emphasis on operational systems. Registries. Disclosure requirements. Centralized coordination. We'll probably see more of this approach over time.

A Realistic View

DROP is not a complete solution nor a token gesture. It will take action in accordance with the law. It creates transparency. It reduces barriers to consumer access.

DROP won’t prevent the data from being returned or eliminate the harm that has already been done. And it doesn't neutralize bad actors operating outside the system. Knowing the difference is important. At times, the most valuable contribution from a new program is not necessarily what it corrects immediately, but what it allows us to see about the true extent of the problem.

C.K. Redlinger is senior privacy and intelligence officer at 360 Privacy.