The Delete Button Data Brokers Fear and How It’s Changing Privacy for Californians

Ever googled yourself and found your personal details scattered across shady people search sites, only to realize that removing them feels like playing privacy whack-a-mole? You’re not alone. In this episode of Tech Brewed, Greg Doig dives into the shadowy world of data brokers: companies quietly trading in millions of personal records, from health and shopping habits to political views. But something big just changed. As of August 1st, California has introduced America’s first true “delete button”—a single, free request that forces more than 500 data brokers to erase, and keep erasing, what they know about you. Does it work? Will it spread? And what about the rest of us outside California, still stuck in the perpetual game of digital hide-and-seek? Stay tuned as we break down how this historic privacy law works, which tools really protect you, and what comes next in the fight to control your own data.

Further Research

https://consumer.drop.privacy.ca.gov/

https://www.eff.org/deeplinks/2026/07/what-you-need-know-about-californias-drop-tool#Filing

https://lapublicpress.org/2026/07/data-broker-california-drop/

Transcript

0:00

The delete button the data brokers didn't want. Welcome back, tech enthusiasts. I'm your host, Greg Doig. There's a company in Texas you may not have heard about called DataMasters, or maybe you have. Anyways, until California caught up with them, one of the things they sold was lists of people with Alzheimer's disease. Not a hypothetical. Names, addresses, phone numbers, emails, millions of people. People with Alzheimer's, people with drug addiction. They also offered senior lists, Hispanic lists, lists of people by their political views, by what they bought at the grocery store, by their banking activity. In January, California's privacy agency fined them$45,000 and ordered them out of the state's market entirely. The head of the enforcement, Michael Mackow, put it about as plainly as a regulator ever has. Reselling lists of people battling Alzheimer's disease is a recipe for trouble. History teaches us that certain types of lists can be dangerous. Here's why I'm telling you this today. As of August 1st, there is, for the first time anywhere in America, a delete button for this entire industry. One free, legally binding request that forces more than 500 data brokers to erase what they have on you. And keep erasing it. The catch? It only works if you live in California for now. I don't. Most of the people listening probably don't. But today, how the delete button works, whether it'll actually stick, and what the rest of us can do instead, including the one approach Consumer Reports found actually beats the paid services. Let me tell you a story you've probably lived. You Google yourself, you find your address, your age, your relatives on some people search site. You dig up their opt-out page. It's buried way down at the bottom somewhere. And it wants your email, maybe a photo ID. You do it. It works. 3 months later, you're back on the site, new listing rebuilt from public records and data bought from other brokers. So you consider paying someone like DeleteMe or Incogni, which are subscription services. And it feels like a whack-a-mole. The natural question, does paying even work? Consumer Reports actually tested this. In 2024, they ran Data Defense, tracking 13 paid removal services across 32 real volunteers for 4 months. Their verdict? Largely ineffective. Even when removals happened, the listings came back more than half the time because brokers rebuild from public records breaches and buying from each other. And here's the kicker. Doing it yourself beat every paid service they tested. That's the game. You delete, they rebuild forever. Which is exactly why what California switched on is different. Because for the first time, the rebuilding part is what's illegal. As of August 1st, Californians can make one free legally binding request that forces 500+ data brokers to delete their data and keep deleting it every 45 days. Almost nobody's using it yet. Here's what it is. California's DELETE Act created DROP, the Delete Request and Opt-Out Platform, run by the state privacy agency, CalPrivacy. It's been live since January. Brokers were legally required to start processing on August 1st. Here's how it works in 3 steps. First, prove you're a Californian. Through the state's identity gateway or Login.gov. It takes minutes. The verification info isn't kept. Second, fill out a short profile. You choose how much to share. More identifiers, better matching. Third, submit. One request goes to more than 500 registered brokers. You can even file for your kid or an elderly parent, and it's free. The state's line is, we will never charge you to use DROP. Timeline? Honestly, brokers have to check the list at least every 45 days and finish deleting within 90. So figure 3 to 4 and a half months before you're actually out. Slower than the brochure, but here's the part that matters. It repeats. Every 45 days, brokers have to delete whatever new data they've collected on you since. That's the state's own description. This is the answer to the rebuild problem. The first mechanism that attacks the repopulation, not just today's listing. And plainly, every removal tool you've tried fights the last copy of your data. This one fights the next copy. Of course, a law is only as real as its enforcement. So does anyone actually get punished? Turns out already, yes. Remember Data Masters? That wasn't a courtesy warning. $45,000 and ordered to stop selling Californians' data entirely. Same enforcement round, S&P Global— yes, that S&P— was fined $62,600 for failing to register as a data broker. Their explanation? Administrative error. The lesson? The registry sweep catches everyone, household names included. CalPrivacy runs a dedicated data broker enforcement strike force. More than 10 actions against unregistered brokers so far, A broker that doesn't register at all? $200 a day in fines plus back fees. New disclosure rules this year also force brokers to admit what they collect, down to whether they've shared your data with foreign actors, law enforcement, or companies training generative AI. As CalPrivacy's Executive Director Tom Kemp put it, Californians have a clear way to push back and regain control now that CalPrivacy's drop system is live. I highly recommend that you sign up for DROP, said Tom Kemp. And this is great advice for the small slice of the country it applies to. Full disclosure, again, I'm not a California resident. I went looking for the workaround. There isn't one right now. Residency is verified at signup. This tool is real and it is fenced. The interesting fight of the next 2 years is which state copies it first and whether Congress keeps ignoring the fact that your protection currently depends on your zip code. So does the delete button actually deliver? And my best answer so far is nobody on earth knows yet. Enforcement started August 1st. Brokers get up to 90 days. The first completed deletions land around November. Anyone claiming results today is guessing. For what filing feels like right now, credit where it's due. LA Public Press published a step-by-step walkthrough of the process, and EFF has a solid explainer, both linked in the show notes. So the promise from the top, you now know what the delete button is, one free request to 500 brokers that re-deletes every 45 days for Californians. And you know it has teeth, ask DataMasters. You know the honest timeline, 3 to 4 and a half months, first real results this November. And if you're outside California, you know the Consumer Reports play, DIY first. And if you pay, pay $20, not $200 or the best deal going at the time you look. If this episode was useful, the best thing you can do is send it to one person who's been paying for a removal service and they may want their money back. So once again, I'm Greg, this is Tech Brood, and we'll talk to you soon.