California residents can use a new tool to require real estate agents to delete their personal data | TechCrunch

California is giving residents a new tool that should make it easier for them to limit data brokers’ ability to store and sell their personal data.

While state residents have had the right to demand that a company stop collecting and selling their data since 2020, this required a laborious opt-out process from each individual company. The Removal Act, 2023 is overwas supposed to simplify things, allowing residents to make a single request to more than 500 registered data brokers to delete their information.

Now the Remove requests and opt-out platform (DROP) actually gives residents the opportunity to make that request. Once DROP users verify that they are California residents, they can submit a takedown request that will go to all current and future data brokers registered with the state.

But that doesn’t necessarily mean that all your data will be deleted immediately. Brokers would start processing requests in August 2026, after which they would have 90 days to actually process requests and report back. If they do not delete your data, you have the option to submit additional information that will help them find your data.

Companies can also keep first-party data collected from users. Only brokers who want to buy or sell this data (including your social security number, browsing history, email address, phone number and more) will have to delete it.

Some information, such as vehicle registration and voter information, is exempt from deletion because it comes from public records. Other information, such as sensitive medical information, may be covered by other laws, such as HIPAA.

The California Privacy Protection Agency says that in addition to giving residents more control over their data, the tool could result in fewer “unwanted texts, calls, or emails” and also reduce the “risk of identity theft, fraud, AI impersonations, or having your data leaked or hacked.”

The fine for data brokers that fail to record or delete requested consumer data will be $200 per day, plus enforcement fees, according to the agency.