Data Broker Deletion Works. The Copy Came First | Elacity
California's DROP tool now has data brokers erasing profiles at scale. Deletion still acts after the copy is sold. Ownership means setting the terms before the first use.
Data Broker Deletion Finally Works. It Still Starts After the Copy Is Made.
If you live in California, you can now send one request and have over 650 registered data brokers erase what they hold on you. Data broker deletion, a right that lived mostly on paper for years, finally runs at scale. What it cannot reach is the moment that cost you: the day your data was copied, packaged and sold without you in the room.
Credit where it is earned. CalPrivacy says the profiles brokers report deleting through its Delete Request and Opt-out Platform, known as DROP, are approaching 100 million, with more than 560,000 Californians signed up. For a law many expected brokers to ignore, that is a real result.
The harder question is what kind of power that result describes.
What Data Broker Deletion Actually Gives You
Deletion is a demand you make of someone else's database. Since August 1, registered brokers must check DROP at least once every 45 days and face $200 per day for each request they fail to process. Brokers were given until November 1 to report back on the requests filed so far, which makes it the first real test of enforcement.
Notice the shape of the transaction. The broker holds the copy, decides how to match your record, and reports a status back. You receive a dashboard of verdicts about data you never saw.
The verdicts have edges, too. CalPrivacy's own FAQ lists information you provided to a broker directly, and information drawn from public records, as common examples of data exempt from deletion. The data you handed over yourself can be the data this tool cannot touch.
The Copy That Already Left
A deletion request acts on what a broker still holds. It says nothing about what was already sold. Stanford HAI researchers point out that 32 brokers in California's 2026 registry disclosed selling consumer data to generative AI developers, and that almost nothing is known about how those developers use it.
A record erased from a broker's server this November does not climb back out of a dataset licensed the year before. Whatever a buyer did with it happened under the buyer's terms, never yours.
Compliance is uneven even for the copy still in reach. Before brokers had to use DROP, UC Irvine researchers sent deletion requests to every California-registered broker they could contact; most never sent the answer the law requires, and a few confirmed deleting records for a person who did not exist.
Other states are following, and the newest shows the ceiling. New Jersey's new law, which one Bloomberg Law analysis calls the broadest to date, leaves enforcement entirely to the state: the person whose data was sold has no private right to sue.
Rights Granted After the Fact, or Terms Set Before It
Every technology encodes a theory of power. Privacy law, even good privacy law, assumes the copy already lives somewhere else and hands you levers to pull afterwards: see it, stop its sale, ask for its erasure.
Ownership starts one step earlier. The question stops being whether they will forget you and becomes what anyone may do with this, for how long, and on whose terms. It is answered before the first use, not after the hundredth.
That is the gap Elacity is built for. Elacity turns data, work and IP into property you control: a Wealth Capsule, an encrypted, programmable good with its rights and royalties written in, which humans and AI agents pay to use. Our guide on how to turn your data into capital covers the basics; here is what changes about where the rule lives.
Where the Rule Lives in a Wealth Capsule
- The content stays encrypted everywhere except a sealed moment of use. The buyer's software gets the working result, never the key or a clean copy to resell.
- The key is split across multiple independent machines in an owned 2-of-3 quorum. No single operator, Elacity included, holds it.
- Each of those machines re-checks the buyer's on-chain rights before releasing its share. If the rights record no longer says yes, the shares stay put and the unlock fails closed.
- Terms are enforced at every use instead of petitioned for after the sale, which is the core of who holds the key in decentralized DRM.
Elacity dDRM runs on ElastOS, the open-source Elacity runtime/home beneath it, where your own machine is the source of truth and the cloud is only a guest.
The Honest Limits
None of this reaches back into broker profiles that already exist, built from records you never held in the first place. For that past, deletion law stays necessary, and California's version deserves to spread.
Sealing limits copying, not learning: a buyer that used your data under a valid license keeps what it learned. The consumer Create-and-sell portal on the Elacity Exchange is still being built. What ships today is the mechanism underneath it: encrypted goods, split keys, and a rights check on every unlock.
Sasha Mitchell, Elacity's founder, puts the aim plainly:
The people who create the value should own it. That is the entire reason Elacity exists.
Deletion lets you leave a market you never agreed to join. Ownership lets you decide whether to enter one, and on what terms. More on that shift lives in our Sovereign Capital coverage.
Follow Elacity on X to watch the ownership layer get built.