Stanford study finds most data brokers not honoring California deletion rights

Stanford researchers reviewed all 522 data brokers that had registered in California. After the state's 1 July 2025 transparency deadline, only 9% fully reported the required numbers on consumer requests — deletion, correction, right-to-know, sale and sharing, opt-out, sensitive-data limits, wait times, and how many requests they granted or denied. 45% sent the state no request numbers at all. Stanford announced the findings on 11 August 2026; the researchers' paper was posted in May 2026.

In a separate check of a random 250 brokers' websites, 64% used at least one design that made a request harder, and 43% made it impossible to use every privacy right. That included CAPTCHA puzzles (21%) and forcing people to resubmit the same form or complete several identical ones (43%). This was not a hack, and no new types of personal information were allegedly stolen. California's DROP mass-deletion system started processing on 1 August 2026; by early September about 520,000 people had signed up.

This was not a leak. That does not mean your data is gone.

Most coverage treats this as a report card on companies versus a California law. That is accurate, and it is easy to file away if you do not follow regulation. It is the wrong frame if you saw the story and wondered whether you should be afraid for yourself.

Your information was not newly taken from a bank, a hospital, or an app you log into. Data brokers already buy and sell everyday records: names, addresses, location, health and financial details, how you behave, relationship information, and guesses they infer about you. California's law was supposed to give you a way to tell that industry to delete you. Stanford measured whether the registered firms actually report doing that work, and whether their websites let you ask. Most do not.

So the line that “no new personal information may have been exposed” is true, and it sounds like comfort. The honest reading of the same facts is less comforting: the file was already out there, and the legal off-switch built to pull it back is not being operated in any complete way by nine out of ten of the firms that registered. If you are one of the roughly 520,000 people who signed up for DROP, that was a reasonable step. It is not proof a broker erased you. The study looked at transparency and request-process rules that were already in force before DROP processing began. The researchers noted some improvement over time and still described overall compliance as surprisingly low. No company or trade group has publicly disputed the figures. The state privacy agency has not published its own audit of this study.

There is also no roster of “people affected.” This is research about how an industry behaves, not a dumped list of names. Nobody can honestly tell you, from this paper, whether a particular broker still has a card on you.

What to actually expect

• You will not get a notice that you were “in” this. There is no incident list to match you against, and there will not be a personal all-clear either.
• People-search pages and broker listings about you will, in the near term, look much like they do today. This study did not take those pages down.
• If you already used DROP or a broker's own form, do not treat a confirmation screen as evidence of deletion. After the 2025 deadline, 45% of registered brokers filed no request numbers at all, and only 9% filed the full set the law requires.
• Do not wait for California's privacy agency to answer this paper with a letter that names you. It has gone after brokers who never registered; it has not publicly addressed these Stanford figures.

What you can and cannot fix

Copies of ordinary records that brokers already collected and already sold cannot be called back. Those copies are in other companies' hands. This study did not publish your file, and it did not create a new dump — but it also does not mean your file was removed. That part cannot be undone.

• If you are a California resident and you have not used the state's DROP deletion system, use it. It is still the official way to send one deletion instruction covering names, addresses, location, health, financial, behavioural, and relationship data, plus inferences, to registered brokers. Do not treat a sign-up as a completed erasure.
• Spend your effort on people-search sites that publish you in public. A thin broker record becomes much more useful to a scammer or anyone building a dossier when it is joined to listings that add relatives, phone numbers, employers, and previous addresses. Unlike copies already resold in the wholesale market, those public listings can actually be taken down.
• Do not try to personally complete request forms at all 522 brokers. Stanford found 64% of the sample added friction and 43% blocked full use of the rights, including repeat forms and CAPTCHAs. That time is better spent on the public listings you can actually remove.
• If you do not live in California, DROP is not aimed at you. People-search opt-outs are still the lever that removes what other people can see. Changing every password because of this paper will not address what the researchers found: this was about records brokers already held, not about stolen logins.