DROP is free and available to California residents, who verify their residency through the California Identity Gateway before submitting a request at privacy.ca.gov/drop.

Should I use both GPC and DROP?

They cover different things, so many California residents use both: GPC in the browser for ongoing opt-outs on the sites they visit, and DROP once to ask registered data brokers to delete existing data.

California privacy, explained

GPC vs. DROP: two California privacy tools that do different jobs

Q: What is the difference between GPC and DROP?

Global Privacy Control (GPC) is a browser signal that tells each website you visit not to sell or share your personal information from now on. DROP, California's Delete Request and Opt-out Platform, is a state website where California residents send one request asking more than 600 registered data brokers to delete the personal information they already hold. GPC works going forward with the sites you visit; DROP deals with data brokers you may never have heard of.

Q: Does GPC delete my data?

No. GPC is an opt-out of selling and sharing. It asks businesses to stop selling or sharing your data from the point they receive the signal, but it does not delete data they already have. Deletion requires a separate request, or DROP for registered data brokers.

One tells the websites you visit to stop selling or sharing your data from now on. The other asks data brokers to delete what they already have. Here's how each works and when to use it.

GPC · Global Privacy Control

Stops future selling and sharing by the sites you visit

A setting in your browser that sends an opt-out signal to every website automatically. Under California law, covered businesses must treat it as a request to opt out of selling or sharing your personal information, including for targeted advertising.

DROP · Delete Request and Opt-out Platform

Asks data brokers to delete what they already hold

A free state website where California residents send one request to more than 600 registered data brokers, asking them to delete the personal information they have and stop selling it.

Side by side

	GPC	DROP
What it does	Opts you out of the sale and sharing of your data, from the moment a site receives the signal	Requests deletion of personal information data brokers already hold, and stops them selling it
Who receives it	Every website you visit while it's on	Data brokers registered with the California Privacy Protection Agency, including ones you've never dealt with directly
How you use it	Turn it on in your browser or with an extension; it works in the background	Verify your residency and submit one request at privacy.ca.gov/drop
Who can use it	Anyone. California law requires covered businesses to honor it for California consumers, and several other states have similar rules.	California residents
Timing	Applies each time you visit a site with the signal on	Brokers began processing requests on August 1, 2026, and must check DROP at least every 45 days. Status updates can take up to 90 days.
Cost	Free	Free

If you live in California

The two tools cover different ground, so it's reasonable to use both.

Turn on GPC in your browser. Brave and DuckDuckGo send it by default, Firefox has a setting for it, and extensions can add it to Chrome. Starting January 1, 2027, California's Opt Me Out Act requires browsers to offer a built-in opt-out signal setting.
Submit one DROP request at privacy.ca.gov/drop. It's run by the state and free. You can also submit a request for another California resident, such as a child.

DigiBiz360 isn't affiliated with the California Privacy Protection Agency or DROP, and never sees DROP requests. Use the official site directly; you don't need a paid service to submit a request.

If you run a business

If you operate a website

Covered businesses must treat GPC as an opt-out of selling and sharing, and since January 1, 2026 must show visitors whether their signal was processed. In practice, that means ad pixels and tags have to respond to the signal, which often fails quietly when a tag manager fires them independently of the consent setup.

Our free Chrome extension shows which ad vendors your site contacts with GPC on and off, and a technical audit covers every key page and helps fix the setup.

Get the free GPC checker Request a technical audit

If you're a registered data broker

DROP adds a recurring, technical obligation: download deletion lists at least every 45 days, match them against your records, delete matched data, direct service providers and contractors to delete it too, and use DROP data only for compliance. DigiBiz360 can help design the matching and deletion workflow. Contact us.

Common questions

Does GPC delete my data?

No. GPC is an opt-out of selling and sharing going forward. It doesn't delete data a business already has. For deletion, send a request to the business, or use DROP for registered data brokers.

Does DROP cover every company that has my data?

No. DROP reaches data brokers registered in California: companies that collect and sell personal information about people they don't have a direct relationship with. It doesn't send requests to stores, apps, or websites you use directly.

How do I know if a website honors GPC?

Covered sites must show whether they processed the signal. You can also check which ad vendors a site contacts with GPC on and off using our free GPC Compliance Checker. Results are technical observations, not legal conclusions.

I'm not in California. Does any of this apply to me?

DROP is for California residents. GPC works anywhere, and Colorado, Connecticut, New Jersey, Texas, Oregon, and several other states also require businesses to honor opt-out signals like it.

Sources: California Privacy Protection Agency: DROP · DROP regulations · Global Privacy Control. General information current as of September 2026, not legal advice. Check the official sites for the latest rules.