One request. Every data broker in California. Gone. That’s the promise of California’s Delete Request and Opt-out Platform, and by mid-2026 it’s no longer a compliance footnote — it’s actively reshaping which audiences brands can even target. If your media plan leans on third-party data brokers for lookalike modeling or enrichment, the DROP system just became your problem, not just your legal team’s.
What DROP Actually Does
The Delete Request and Opt-out Platform, built under California’s Delete Act (SB 362), gives any Californian a single portal to request deletion of their personal information from every registered data broker in the state simultaneously. No more filing forty separate opt-out requests with forty separate companies. One form, one verification step, and the request cascades to every broker on the California registry.
This isn’t a rebrand of the CCPA’s existing deletion rights. It’s an entirely new mechanism, operated by the California Privacy Protection Agency (CPPA), that scales individual requests into a broker-wide purge. Brokers have a fixed window to process deletions and must delete data at least once every 45 days going forward for repeat requesters. Miss the window, and the exposure isn’t theoretical — the CPPA has enforcement teeth and has shown willingness to use them.
DROP turns what used to be a slow, broker-by-broker trickle of opt-outs into a mass deletion event — and brands relying on broker data for targeting are discovering their audience pools can shrink overnight.
Why Brands Should Care About a Consumer-Facing Tool
Here’s the part marketing teams keep missing: DROP isn’t aimed at brands. It’s aimed at brokers. But your programmatic buys, your CRM enrichment, your lookalike audiences built on third-party identity graphs — all of that runs through broker infrastructure that DROP is actively thinning out.
Think about how many vendors in your martech stack touch broker data without you realizing it. Identity resolution platforms, clean room providers, even some influencer-matching tools pull enriched profiles from registered brokers to fill gaps in first-party data. When a broker deletes records en masse, those enrichment pipelines quietly degrade. You don’t get an alert. You just get worse match rates and higher CPMs, with no obvious cause until someone audits the data supply chain.
This is the same pattern we’ve seen with other platform-level data shifts — TikTok’s US data localization requirements forced brands to rethink where creator and audience data physically lives. DROP is a state-level version of the same disruption, except it hits the broker layer instead of the platform layer.
The Scale Problem Nobody’s Pricing In
California has roughly 39 million residents, and it’s the fifth-largest economy in the world on its own. A meaningful share of any national brand’s US audience data touches California consumers at some point, whether they live there now or their data was collected there years ago. Statista estimates the US data broker industry generates well over $200 billion annually, and California brokers represent a disproportionate share given the state’s tech concentration.
Early CPPA registry data shows several hundred brokers registered in the state, spanning everything from niche B2B contact databases to consumer-facing identity resolution giants. If even a fraction of California’s population files DROP requests, and awareness campaigns from privacy advocates suggest adoption is accelerating, brokers could see meaningful deletion volume within a single fiscal year. That’s not a rounding error for brands buying audience segments at scale.
The uncomfortable question for CMOs: do you actually know which of your vendors are registered data brokers under California law? Many marketing teams assume “we don’t buy from data brokers” simply because no line item says “data broker.” But identity graph providers, co-op data networks, and even some loyalty program data resellers often meet the legal definition. If your vendor list hasn’t been audited against the CPPA broker registry, you’re flying blind on exposure.
Operational Fallout: Audience Modeling Takes a Hit
Marketing teams that rely heavily on broker-sourced lookalike audiences are going to feel this first. Lookalike modeling depends on volume and data freshness. As DROP-driven deletions chip away at broker datasets, the seed audiences used to train these models get smaller and staler. The practical result: audience segments that used to convert at a predictable rate start drifting, and nobody on the media buying side knows why until they trace it back to broker-side attrition.
There’s a parallel here to how data residency rules have broken ad targeting on other platforms. Whenever the underlying data pool shifts due to regulation, targeting precision degrades before anyone updates the playbook. Brands that treat this as a one-time compliance check rather than an ongoing operational risk will keep getting surprised by it.
Agencies running influencer and affiliate programs should be especially cautious. If a broker relationship feeds audience data used to vet creator-brand fit or model fan overlap, DROP-driven deletions could quietly degrade the quality of those recommendations. This isn’t just a media-buying problem — it touches influencer selection tools too.
Contract Language Just Got More Important
Most brand-broker contracts were written before DROP existed. That’s a problem, because the platform introduces new obligations around deletion cadence, verification, and downstream notification that older data processing agreements simply don’t address.
Brands need to revisit broker contracts and ask pointed questions: How does this broker verify DROP-originated deletion requests? What’s their process for notifying downstream licensees, meaning you, when data gets deleted? Do they guarantee compliance with the 45-day recurring deletion cycle, or are they treating it as a one-time event?
This mirrors the diligence brands have had to apply to data processing agreements for platform APIs. The same rigor now needs to extend to every broker relationship feeding your targeting stack. If your legal team hasn’t updated broker DPAs to reference the Delete Act and DROP specifically, that’s a gap worth closing this quarter, not next year.
A broker contract that doesn’t mention DROP by name is a contract written for a regulatory environment that no longer exists.
Compliance Isn’t Just a Broker Problem
There’s a temptation to treat DROP as purely a broker liability issue — let them handle deletion, and it’s not your concern. That reasoning falls apart fast under actual scrutiny. If your brand receives data from a broker who failed to properly process a DROP deletion, and you continue using that consumer’s data for targeting, you inherit exposure too. Downstream use of improperly retained data is exactly the kind of fact pattern the CPPA and plaintiff’s attorneys look for.
The FTC has also signaled increasing interest in data broker practices more broadly, and state-level enforcement often becomes a template other states copy. Several states are already watching California’s DROP rollout as a model. Brands operating nationally should assume similar deletion infrastructure lands elsewhere within a couple of enforcement cycles. Building a California-specific patch instead of a scalable process is short-term thinking.
This is also a good moment to apply the same data minimization discipline brands have started using for other high-risk data flows. The principles outlined in data minimization frameworks for identity tools apply just as well here: collect and retain only what you need, verify vendor compliance regularly, and don’t assume a contract clause equals actual practice.
What a Practical Response Looks Like
- Audit your vendor list against the CPPA data broker registry to identify hidden broker relationships.
- Update DPAs with every broker to explicitly reference DROP compliance, verification processes, and deletion cadence.
- Build monitoring into media performance dashboards so audience degradation gets flagged early, not discovered three months into a campaign.
- Diversify toward first-party data where possible, reducing dependency on broker-sourced enrichment for core targeting.
- Loop in legal early when negotiating new broker contracts, since DROP-specific language is still maturing across the vendor landscape.
None of this is glamorous work. But it’s cheaper than discovering mid-campaign that your core audience segment shrank by 15% because a broker quietly processed a wave of deletions and nobody told your media team.
The Bigger Pattern: Consumer Control Is Compounding
DROP doesn’t exist in isolation. It’s part of a broader trend where consumers get easier, more centralized tools to exercise data rights, and brands get less warning before the effects show up in performance metrics. Similar dynamics have played out around FTC enforcement actions on data practices and evolving platform-level privacy tools.
Marketers who’ve watched how quickly platform rule changes ripple through AI-driven targeting and disclosure requirements should recognize the shape of this problem. Regulation doesn’t announce itself with a countdown clock. It shows up as degraded performance, and the brands that investigate the root cause fastest are the ones that adapt without losing a full quarter of campaign efficiency.
Industry research groups like eMarketer have already flagged data broker consolidation and shrinking third-party pools as a multi-year trend independent of DROP. This just accelerates it. Brands still building media plans around the assumption that broker data will remain abundant and cheap are planning for a market that’s already gone.
Next Step
Pull your full vendor list this week and cross-reference it against the CPPA broker registry — don’t assume your legal or procurement team has already done it, because in most organizations, nobody owns that check. Then price out what a 10-20% broker data shrinkage would do to your Q3 targeting performance, and use that number to justify the first-party data investment you’ve been deferring.
Frequently Asked Questions
What is California’s DROP system?
DROP, the Delete Request and Opt-out Platform, is a centralized tool created under California’s Delete Act that lets consumers submit one deletion request that applies to every registered data broker in the state, rather than filing separate requests with each company.
Does DROP apply to brands directly, or only to data brokers?
DROP’s legal obligations fall on registered data brokers, not brands directly. However, brands that license or use broker data inherit risk if they continue using data that should have been deleted, and they may see targeting performance degrade as broker datasets shrink.
How often must data brokers process deletions under DROP?
Brokers are required to check the DROP deletion list and process qualifying deletions on a recurring basis, generally every 45 days, rather than treating deletion as a one-time event.
How can a brand tell if a vendor is a registered data broker?
Check the vendor against the California Privacy Protection Agency’s public data broker registry. Many identity resolution, enrichment, and co-op data vendors meet the legal definition even if their marketing materials don’t use the term “data broker.”
Will other states adopt a system similar to DROP?
Several states are monitoring California’s rollout, and given the pattern of other states following California’s lead on privacy law (as seen with the CCPA itself), brands should expect similar centralized deletion infrastructure to expand beyond California over the next few enforcement cycles.
What should brands do now to reduce DROP-related risk?
Audit vendor relationships against the broker registry, update data processing agreements to reference DROP compliance explicitly, monitor audience performance for signs of data shrinkage, and invest in first-party data collection to reduce broker dependency.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →