August 1 Is 61 Days Away. California's DROP Portal Will Fine You $200/Day Per Unprocessed Request.

most founders i talk to know "data brokers are a thing." fewer know that california's DELETE Act enforcement kicks in on august 1, 2026 — 61 days from now — and the penalty structure is designed to add up fast.

what DROP is and why it matters

California's Delete Rights Opt-Out Portal (DROP) launched january 1, 2026. data brokers registered in california must now check the portal every 45 days and process every opt-out deletion request they find. starting august 1, non-compliance carries a $200 penalty per unprocessed request per day.

if you're a data broker — or if your business model involves buying, selling, or licensing personal data — you're in scope. the CA Privacy Protection Agency is not issuing warnings. the enforcement mechanism is automatic: deletion requests sit in the portal, unprocessed requests accumulate, the clock runs.

how many data brokers are actually out there

the estimate ranges from 180 to 500+ active data brokers, depending on how you define "data broker." the CA Delete Act definition is broad: any business that "knowingly collects and sells or shares" personal information of consumers with whom it doesn't have a direct relationship. that catches a lot of players who didn't think of themselves as data brokers.

if you're a person (founder, exec, investor, public-facing operator), your data is almost certainly on most of them.

what the removal process actually looks like

i built the removal side of this. the BizSuite data removal service pulls you off 48 brokers across 5 tiers — the tiers correspond roughly to how aggressive each broker is about re-listing after removal. some brokers honor a one-time request and stay off. others re-aggregate from new sources within 30 days. tier coverage and monitoring handles that recurrence problem.

the service is $497 upfront + $49/month monitoring. the monitoring piece matters specifically because of DROP enforcement — brokers who are now checking that portal every 45 days and getting deletion requests are simultaneously re-populating their databases from other sources. a one-time removal without monitoring is increasingly the wrong shape.

the practical ask before august 1

if you haven't done a removal sweep, do one before the enforcement date. the cost of being on the wrong broker's list at the wrong time — a doxxing, a fraud attempt using scraped contact data, a journalist finding your home address — is not symmetrical with the $497 cost of removing yourself.

more on what we cover and how it works: https://getbizsuite.com/data-removal.html