Skip to main content Skip to navigation
    hotelcomply

    HotelComply Guest · For California residents

    DROP covers data brokers. Your hotel stay is a separate request.

    California's Delete Request and Opt-out Platform lets you ask every registered data broker to delete your information, in one free request. It does not reach the information you gave directly to a hotel, a booking site or a loyalty program. For those, you ask each organization yourself.
    Go to DROP (official state site) (opens in a new tab)What DROP leaves out

    What DROP does

    One request, every registered broker

    DROP was created by California's Delete Act and is run by the California Privacy Protection Agency. A data broker is a business that collects and sells information about people who never gave it to them directly.
    Who can use it
    California residents. Residency is checked through the state's identity gateway.
    Cost
    Free. The state says it will never charge for DROP.
    Since when
    Requests opened January 1, 2026. Registered data brokers had to start processing them on August 1, 2026.
    How often
    Brokers must check DROP at least every 45 days and keep deleting newly matched data.
    Status
    Brokers have up to 90 days to report how they handled your request. You check status in DROP with your DROP ID.
    What brokers may keep
    Data covered by legal exemptions, such as public records, credit reporting information and HIPAA-protected patient information.

    What DROP leaves out

    Information you gave a business directly

    The state is explicit: information you provide to a business directly is not subject to deletion through DROP. That includes most of a hotel stay. You gave your details to the hotel at booking and check-in, to the booking site when you reserved, and to the loyalty program when you joined.

    Even a company that is a registered data broker only has to delete what it got from other sources. What you gave it yourself needs a separate request.

    • The hotel

      What you may have given

      Reservation, check-in and ID details, folio and payment references, preferences, requests.

      Where to ask

      The property's privacy notice. The brand, owner and operator can be different organizations, so the notice may name more than one contact.

    • Booking site or travel agency

      What you may have given

      Your account, the booking itself, payment and traveler details.

      Where to ask

      The booking company's own privacy request page. A request to the hotel does not cover it.

    • Loyalty program

      What you may have given

      Membership profile, stay history, points activity, marketing choices.

      Where to ask

      The program's privacy or account settings page. Account and marketing choices are often managed there.

    • Wi-Fi, apps and other services

      What you may have given

      Network sign-in details, app accounts, spa or dining bookings, messages you sent.

      Where to ask

      The provider named on the sign-in page, app or receipt. Some of these services are run by companies other than the hotel.

    Covering both

    Brokers through DROP, the stay directly

    Under the California Consumer Privacy Act, businesses it covers must respond to requests to know, delete or correct your information, and to stop selling or sharing it. Each business is a separate request.

    1. 01

      Use DROP for data brokers

      One free request covers the brokers registered with the state. It is the right tool for companies you never dealt with.

    2. 02

      List who you dealt with

      From your confirmations and receipts: the hotel, the booking channel, the loyalty program and any separate service providers.

    3. 03

      Ask each one directly

      Find each organization's privacy notice and use its request method. Each business is a separate request.

    4. 04

      Keep what comes back

      Save confirmations, dates and replies with the record of the stay, so you know what you asked and who answered.

    Start with the list for step two

    A Stay Footprint turns the services you used into a record of what each one may involve and which questions to ask. It does not find or delete records for you.

    No account, calendar access or subscription. Your stays are saved only in your browser.

    Create my Stay Footprint

    Questions

    Straight answers

    Is a hotel a data broker?

    Usually not for the information you gave it. The state describes a data broker as a business that sells information the consumer did not give it directly. A booking, a check-in or a loyalty account is information you gave directly.

    If a company is a registered broker and I also booked with it, does DROP cover everything?

    No. The state says such a broker must delete what it got from other sources, but not what you provided directly. That part needs a separate request.

    Will DROP stop a hotel's marketing emails?

    Not marketing from a business you dealt with directly. Use the unsubscribe link, your loyalty account settings, or a request to that business.

    I stayed in Europe or the UK. Does this apply?

    DROP is a California program. A stay with a business established in the EU or UK may fall under GDPR or UK GDPR instead, which has its own request rights. Start with the hotel's privacy notice either way.

    Can HotelComply Guest send requests for me?

    No. Guest does not submit requests, connect to hotel systems or check what a hotel holds. It helps you list the services and organizations involved in a stay so you know whom to ask.

    Is this legal advice?

    No. This page summarizes official state guidance. Whether a right applies depends on where you live, the business and the circumstances. For advice about your situation, talk to a qualified attorney.

    Sources

    Official state guidance

    Dates and rules come from these pages. Last reviewed November 1, 2026. If they differ from this page, the official pages are correct.

    Back to HotelComply Guest