quietlistStart your free cycle

The DROP guide for data brokers

What California’s Delete Request and Opt-out Platform asks of a registered data broker, written for the ones without a privacy team.

By Alon, founder of Quietlist · · A summary, not legal advice

A woman operating an Addressograph mailing-list printer beside rows of card-file cabinets in an office
An Addressograph, which printed mailing lists from metal address plates, in a Washington office between 1909 and 1940. National Photo Company Collection, public domain, via Wikimedia Commons.

What DROP is

DROP is the Delete Request and Opt-out Platform, run by the California Privacy Protection Agency (CalPrivacy). It was created by California’s Delete Act. Instead of writing to hundreds of data brokers one at a time, a Californian makes a single request on DROP, and every registered data broker has to act on it.

For a broker that used to receive a few deletion emails a year, the change is one of scale. By October 2026 more than 550,000 Californians had signed up, and every registered broker receives the same list.

Who has to use it

Every business registered with CalPrivacy as a data broker. That includes list brokers, people-search sites, B2B contact and lead-generation data companies, and location and ad-tech data businesses. Size does not matter: a two-person list agency has the same obligation as a large one.

The 45-day cycle

From 1 August 2026, a registered broker must access DROP at least once every 45 days. Each time, the work has the same shape:

  1. Download the current deletion lists for your broker account.
  2. Match them against the personal information you hold.
  3. Delete what matches, and tell your service providers and contractors to do the same.
  4. Report a status for each request back to DROP before the cycle closes.

Then the clock starts again. Missing a cycle is not a paperwork slip; each request left unprocessed carries its own daily fine.

How matching works

DROP does not hand you names and email addresses. Its lists hold identifiers that have been normalised and hashed with SHA-256, a one-way function that turns jane.doe@example.com into a fixed 64-character code. To find a match, you hash your own records the same way and compare codes. If the codes agree, you hold that person’s data.

This has two consequences for a small broker. Your records have to be cleaned into the same format before hashing, or real matches are missed. And the codes are still personal information under California law, so anyone who handles them for you needs a proper service-provider agreement.

CalPrivacy publishes the exact formats on its processing guidance page. Check your process against it rather than against a summary, including this one.

A black rotary desk telephone beside a small 1943 student telephone directory
A student telephone directory, 1943. University of Alberta Archives, public domain, via Wikimedia Commons.

After the first deletion

A request does not end when you delete a record once. The person stays on the list, so data about them that arrives later, from a new source or a fresh import, has to be caught and removed in later cycles, and must not be sold or shared. In practice that means keeping a “never add back” list of matched codes and checking every new batch of data against it.

Some information may be exempt because other laws cover it. Which exemptions apply to your business is a decision for you and your counsel; what matters operationally is that each decision is recorded with the request it applies to.

Fines and audits

A broker that fails to process a deletion request faces an administrative fine of $200 for each day it goes unprocessed, plus the costs of enforcement. Across even a handful of missed requests, that adds up quickly.

From 1 January 2028, data brokers must also have their compliance independently audited every three years. An audit asks for evidence: when lists were downloaded, what was matched, what was deleted, and when statuses were reported. A broker who has kept a timestamped log of each cycle has that evidence ready; one who has not will be reconstructing it from inboxes.

A plan for a small broker

There are four realistic ways to handle DROP: build and run it yourself, buy a self-serve tool and run the cycle yourself, buy an enterprise privacy platform, or have someone run the cycle with you. Whichever you choose, check that it covers all of these:

  • Every list is downloaded before its 45-day window closes.
  • Your records are normalised and hashed in the state’s format, without sending raw personal data anywhere it does not need to go.
  • Matches turn into a plain to-do list someone at your company actually works through.
  • A “never add back” list catches the same people in new data.
  • A status for every request is uploaded on time.
  • Each step is logged with a timestamp and kept for the audit.

Quietlist was built to do exactly that for small brokers, for $249 a month with the first cycle free. Your records are hashed in your own browser, so names, emails and phone numbers never reach us.

Start your free cycle See how it works

Sources

This guide summarises public guidance as of October 2026. It is not legal advice. Quietlist is not affiliated with CalPrivacy or the State of California.