Methodology

How the analysis works

CA DROP Broker analyzes what you tell us about your own systems, identifiers, vendors, and workflows, and returns structured operational guidance for your team to execute.

Four categories, never merged

Every statement in an assessment belongs to exactly one of these categories, and is labeled as such.

How findings are prioritized

Findings are ordered by what blocks the next step. Classification questions come first, because they determine whether the obligation applies at all. Standardization and hashing come next, because matching cannot function without them. Access and cadence, ongoing suppression, service providers, and evidence repeatability follow. Where several areas are weak, the assessment names the one that gates the others rather than listing everything at equal weight.

Scoring and status labels

The free check returns a qualitative status — strong starting position, some operational gaps, significant preparation needed, or too many unknowns to assess confidently — rather than a numeric score. When answers contain several unknowns, the assessment says so instead of inferring a position from incomplete information.

Primary sources

Source set in use: DROP technical specifications v1.2.0 · July 2026.

• CalPrivacy — DROP for data brokers
• CalPrivacy — Process DROP requests
• CalPrivacy — DROP technical specifications
• CalPrivacy — Technical specifications: getting started
• CalPrivacy — Technical specifications: working with data
• CalPrivacy — Technical specifications: API operations
• CalPrivacy — Technical specifications: reference
• CPPA — Data brokers
• CPPA — DROP regulations
• CPPA — Data broker DROP regulation text (PDF)
• CPPA — Regulations
• California Delete Act — Civil Code §1798.99.80 et seq.

Requirements, fees, and technical specifications change. Always confirm current details against the official sources above.

Limitations

• This is an operational readiness assessment — not a certification, audit, or legal opinion.
• It cannot determine whether your organization is legally a data broker, or whether you are compliant.
• It analyzes only the information you provide; it does not inspect your systems or data.
• It does not connect to DROP, hold DROP credentials, or process consumer requests on your behalf.
• It does not receive production deletion lists or raw consumer personal information.