Data broker hoarding is rampant. New law lets consumers fight back.

In a significant move to protect consumer privacy, California has introduced a powerful new law aimed at curbing the activities of data brokers who collect and sell personal information. This legislation, which became effective at the start of the year, is among the most stringent in the United States. According to the California Privacy Protection Agency, over 500 companies are currently involved in the relentless pursuit of personal data. These brokers gather scraps of information from a wide range of sources—including automakers, technology firms, and fast-food chains—before repackaging and selling it to marketers and private investigators. The nonprofit organization Consumer Watchdog reported in 2024 that these data brokers compile extensive profiles based on individuals’ financial activities, purchases, family dynamics, and even their habits related to food, exercise, travel, and entertainment. Previously, California’s Delete Act, implemented two years ago, allowed residents to request copies of their data and demand its deletion. However, it was found that only a mere 1 percent of Californians utilized these rights during the first year, largely due to the cumbersome process requiring individuals to file separate deletion requests with each data broker. The newly enacted DROP (Delete Request and Opt-out Platform) law simplifies this process. Under DROP, California residents can now submit a single request to have their data deleted and prevent any future collection. The California Privacy Protection Agency will handle the distribution of these requests to all relevant brokers, making it significantly easier for residents to take control of their personal information.