DROP Guide

California DROP, explained for the team that has to operate it

Each page separates official requirements from our operational recommendations and from the questions you should verify with counsel.

• California DROP for Data Brokers

  DROP is California's centralized mechanism for consumers to submit a single deletion request that reaches registered data brokers. This page covers the operational shape of that obligation.

  Read →

• How to Process DROP Deletion Requests

  A single DROP processing cycle has a predictable shape. Getting it written down is what makes it repeatable across staff changes and 45-day cycles.

  Read →

• The DROP 45-Day Access Requirement

  The 45-day cadence turns DROP from a project into a recurring operating obligation. It is the single most useful constraint for planning your implementation.

  Read →

• DROP Identifier Standardization and Hashing

  Matching is only as good as standardization. Identical consumers produce different hashes when normalization rules differ, and the failure is silent.

  Read →

• DROP Consumer Deletion Lists

  List selection should follow an identifier inventory, not the other way around. Choosing lists you cannot match wastes cycles; missing lists leaves requests unprocessed.

  Read →

• DROP API vs. Manual Processing

  Both approaches can work. The right choice depends on record volume, cycle frequency, system count, and how much manual handling your team can sustain every 45 days.

  Read →

• DROP Suppression and Ongoing Request Handling

  Processing a request once is not the end state. Records acquired later that match a prior request generally require continued handling.

  Read →

• DROP, Service Providers, and Contractors

  Your internal processing can be correct while downstream copies remain untouched. Vendor handling is usually the least-mapped part of a DROP workflow.

  Read →

• DROP Status Reporting and Amendments

  Reporting is where a processing cycle becomes evidence. Outcome categories need consistent internal definitions before staff start applying them.

  Read →

• DROP Registration and Access Fees

  Registration and access are administrative gates with lead time. Sequencing them ahead of engineering work avoids a ready pipeline with no access.

  Read →

• The California Delete Act and Data Brokers

  The Delete Act is the statutory source of the DROP obligation. Understanding the structure helps separate legal requirements from implementation choices.

  Read →