DROP drops for consumer privacy

California this year launched an online site to put teeth into the 2023 California Delete Act. It could be the most powerful privacy tool consumers have ever had. It could also create havoc for the data broker and social media industries.

On January 1, the California Delete Request and Opt-out Platform (DROP) is an online tool allowing residents to remove and opt out of data collection. On the site, consumers enter personal identifiers, including phone numbers and email addresses currently in use. After submit the request, data brokers must process the deletion request within 45 days. The starting date, August 1, 2026, gives brokers the time to establish internal processes. People requesting the deletions can check their DROP status after that date to see if your data was deleted. They can add more information about themselves at any time. New data can take up to 90 days to process.

California’s Delete Act was a step forward, but lacked the mechanism to allow consumers to easily get their data removed. Instead of a single place, they contacted every company they knew carried their data and submitted a letter requesting deletion. But they had to know where that data was to issue a request, and they would never know if it had ever been deleted. The state also now offers a website allowing residents to know how many data brokers are collecting data.

Expanding interest

DROP is a one-stop shop for that action. Currently, California is the only state that has this ability and only California residents can use it, but the idea is gaining traction nationally. Tom Kemp, an author and entrepreneur who helped craft the original California law alongside Sen. Josh Becker, has been advising lawmakers in Illinois, Nebraska, and Vermont on similar bills.

Kemp estimated data brokering is a $250–$300 billion per year industry spanning roughly 4,000 companies. Industry groups, including advertising associations, have pushed back, calling the law “novel and untested.” They arguing it hurts small businesses relying on data broker leads for customer acquisition. But there are serious questions whether the data they sell is legal or accurate.

The broker industry relies heavily on data access they buy from Google, Meta and X, but industry estimates show that 30 percent of Google data, 40 percent of Meta, and as much as 70 percent of X are nothing more than bots. In fact, the presence of bots in marketing data is significantly eroding the value of digital marketing.

Accelerating trend

Evan Kaeding, Director and Solutions Engineering at Supermetrics, a Finnish company developing tools for data integration and marketing intelligence, thinks this will not affect marketers as much as the data broker industry itself.

“DROP accelerates a trend that was already happening,” he said. “Digital marketers rely less on third-party enrichment and more on first-party, consented data and privacy-safe activation. This sets a clear standard for what is acceptable and what isn’t. Sending around raw files with names, emails, phone numbers, device IDs and more has been unacceptable for some time and will continue to be. Marketers who grow faster in this environment will deliver real, measurable business impact within a consent-driven framework.”

There are no laws against selling fraudulent or manufactured data, only fraudulent products and services. There is nothing stopping the major FAANG platforms from providing access to that data to third-parties. It is, however, increasing distrust of digital content from those sources. Marketers are recognizing that lack of trust, according to Landon Murie, CEO of the digital marketing agency Gooduju in Lehi, UT.

“The DROP law limits the invisible data marketers use to make decisions,” he explained “That makes digital targeting will be less granular, but more honest. Cleaner, consented data might result in a short-term decline in performance, but can actually improve long-term effectiveness. From a security standpoint, the fewer records saved means a smaller risk profile — and that’s good for consumers.”

Endangered business model

For data brokers, however, their entire business model is endangered. “Brokers now face higher compliance costs and smaller data pools, diminishing the value of bulk consumer profiles,” Murie stated. “Some brokers are moving towards aggregated or anonymized insights rather than individual-level data. Others will quietly shut down as enforcement reveals how fragile their business models are.”

This isn’t the end of digital marketing according to the sources contacted for this report, but it does restore value to what legacy media can provide. Pew Research last year reported that legacy media holds a significant lead in public trust over social media. Over the entire political spectrum, 56 percent trust what they read and watch in national legacy media and up to 70 percent for local. However, only 37 percent trust social media.

“Legacy media is not replacing digital, but it can definitely restore credibility and trust,” Murie stated. “It also provides reach without the privacy issues that digital platforms face. Marketers are leaning on traditional media to build credibility, while allowing digital to drive action. It’s a matter of using the appropriate channel for the appropriate purpose.”

Targeting social media

While the Delete Act and DROP do not apply to social media companies, Assembly Bill 656, titled the Account Cancellation Act, does. This act also went into force on January 1, and it requires social media companies to make it easy for users to delete their accounts as well as all personal information associated with those accounts. Although there are no accurate numbers about account deletions, estimates show a remarkable exodus of users from Facebook, Instagram, and X in the past year in the millions.

That has led to concerns in the advertising industry about whether their social media budgets are worth what they are paying for. But as the platforms increasingly replace human users with bots it is increasing the potential for fraud and other cybercrimes. AI-driven bots now account for 37% of total internet traffic, as reported in early 2024. This number has continued to rise, with automated bot traffic comprising approximately 51 to 80 percent of all web traffic. This shift introduces greater cybersecurity challenges across the digital landscape.