— ERS Briefing 023 · September 2026

Deletion With
Teeth

The commercial market in your home address, relatives, and routines has operated for decades on the assumption that removal requests could be ignored. As of August 1, in the largest US state, ignoring one has a price per request, per day.

Download the PDF →✦ Four pages · No registration required

545

Registered brokers reached by one request

45 days

Mandatory processing cycle

$200

Per request, per day, for failures

What changed on August 1

California's Delete Act created the Delete Request and Opt-Out Platform, DROP, which opened to consumers in January. The enforcement half arrived August 1: registered data brokers must now access the platform at least every 45 days and process the deletion requests inside it, including a perpetual deletion cycle for consumers who opt into ongoing removal, meaning newly collected data about those consumers must be deleted on each subsequent sweep. Noncompliance carries penalties of $200 per request per day, and the regulator has already fined brokers for registration failures. One authenticated request now reaches all 545 brokers on the state registry at once.

The momentum beyond California

On June 30, New Jersey enacted a data broker law with a structural twist: it imposes obligations on both data brokers and the data collectors that supply them, regulating both sides of the supply chain. Connecticut has enacted a registration regime effective 2027, and Vermont updated the country's oldest broker law. Four states now require broker registration, and the direction of travel is uniform. The people-search economy that has quietly powered doxxing, harassment, and pre-attack reconnaissance is entering its regulated era.

Why a security firm cares

ERS traces brokered and leaked data to the front of nearly every targeting case in this year's files. Residential attacks begin with an address lookup. Approach operations begin with relatives, vehicles, and routines assembled from people-search sites. The reconnaissance that once required physical surveillance is now a subscription. Anything that raises the cost and lowers the freshness of that data degrades the attack at its cheapest stage, which is exactly where defense buys the most.

The honest limits

Deletion law reaches registered brokers. It does not reach data already leaked into criminal markets, brokers operating outside US jurisdiction, or public records like property rolls and court filings. A file copied in 2024 is not recalled by a statute in 2026. Treat the legal tooling as one layer of a footprint program, and treat any vendor promising total erasure with suspicion, because the promise is not deliverable.

The working program

For principals and their families, the sequence that works is straightforward. File the DROP request and opt into perpetual deletion, and do the equivalent where other states offer mechanisms. Add a reputable commercial removal service for the long tail of out-of-state and unregistered brokers, with quarterly verification rather than annual. Where law allows, pursue suppression of high-risk public records, an area where eligibility varies and counsel matters. And close the loop with a periodic exposure review, because the objective is not a clean internet, which does not exist, but current knowledge of what a motivated stranger can still find. Making yourself expensive to find is now partly a paperwork exercise. Do the paperwork.

Sources and method

This briefing draws on August 2026 legal analysis of the DROP enforcement date, the California Privacy Protection Agency's published requirements, and coverage of the June 30 New Jersey enactment. Nothing here is legal advice; eligibility and remedies vary by person and state.

Deletion WithTeeth