CCPA and Your Email Address: What Californians Can Actually Do

California gives residents the strongest consumer privacy rights in the US: the right to know what a business holds, to have it deleted, to correct it, and to opt out of its sale or sharing. Since the Delete Act, there's also a single free platform — DROP — that carries a deletion request to every registered data broker at once, which no other state offers.

The rights, briefly

Right to know. What categories of personal information a business collected, where from, why, and who it was disclosed to.
Right to delete, subject to exceptions — active contracts, legal obligations, security.
Right to correct inaccurate information.
Right to opt out of sale or sharing. This is the one that matters most for email, and it's why "Do Not Sell or Share My Personal Information" appears in site footers.
Right to limit use of sensitive personal information.
Right to non-discrimination — they can't degrade your service for exercising these.

Your email address is personal information under this framework, so all of it applies to the address itself. The equivalent question under GDPR

The part that changed things: DROP

The California Privacy Protection Agency built the Delete Request and Opt-Out Platform, at databroker.drop.privacy.ca.gov, where a single verifiable request reaches every data broker registered in the state.

Since 1 August 2026, registered brokers must access it at least once every 45 days and process the deletion requests they find. Brokers register annually in a 1–31 January window, with a 2026 fee of $6,000 plus processing, and the first independent audits are due by 1 January 2028 and every three years after. Source: California Privacy Protection Agency. Checked: 2026-08-19.

This is genuinely unusual. Everywhere else, removal means contacting brokers one at a time. How to use it

Using the rights against ordinary companies

DROP covers registered data brokers. For a company you have a direct relationship with — a retailer, a publisher — you use the rights directly:

Find the privacy contact or the "Do Not Sell or Share" link in the footer.
State that you're a California resident exercising your rights under the CCPA, and which right.
Provide enough to identify your records and no more.
They generally must respond within 45 days, extendable once.
If ignored, complain to the California Privacy Protection Agency or the Attorney General.

The limits

What it doesn't reach

Non-residents. These are California rights. Other states have their own frameworks, generally weaker, and many have none.
Small businesses. The CCPA applies above certain thresholds, so not every company is covered.
Unregistered brokers. DROP reaches those who registered. One that hasn't is breaking the law and still won't see your request through that channel.
Public records. Deletion doesn't reach data published by law.
Permanence. Brokers re-ingest continuously, so deletion is a snapshot rather than a settled state. Why

Where prevention still fits

These rights are retrospective — they act on data organisations already hold. They do nothing about the address you type into a form next week, and the whole cycle starts again.

So the sensible pattern for a Californian is to use DROP for the backlog, since it's free, and per-service addresses for everything going forward. Between them they cover both halves. The two halves · All the free routes