The California Delete Act and DROP

What DROP is

The Delete Act created DROP, the Delete Request and Opt-out Platform, run by the California Privacy Protection Agency (CPPA). It lets a California consumer send one request that reaches every registered data broker, instead of contacting each broker separately. It opened to consumers on January 1, 2026.

What registered data brokers must do

• From August 1, 2026, access DROP at least once every 45 days.
• Each time: download the list of consumer requests, match it against your own records, act on the matches, and report a status for each request back to DROP. The consumer identifiers in the lists are hashed, so matching means hashing your own records the same way.
• Fees: brokers pay an annual registration fee, and there is a fee for access to the request lists.
• New data brokers must have a DROP account before they start operating.
• Audits: independent audits of brokers' compliance are due to start on January 1, 2028, and then every three years. The CPPA is still writing those rules.

The CPPA has reported hundreds of thousands of consumer requests through DROP in its first months, so for most registered brokers each cycle will involve real volume.

What DROP doesn't replace

DROP is one more channel, not the only one. You will still receive requests that arrive by email: from consumers writing directly, from privacy services and other authorized agents acting for them, from people in states other than California, and under laws like GDPR. Those still need answering within their own deadlines; see our guides to privacy service requests and authorized agent requests.

A practical checklist

1. Confirm your registration and DROP account are current.
2. Put the 45-day cycle in a calendar with an owner and a backup.
3. Decide how you'll hash and match your records, and test it on the CPPA's sandbox before relying on it.
4. Keep a record of each cycle: when you downloaded, what matched, and what you reported.
5. Keep your email channel covered too, so requests outside DROP aren't missed.

Official sources: CPPA: data brokers · DROP · DROP for data brokers.

This guide is general information, not legal advice. Privacy laws and regulations change; check the official sources linked above or ask your lawyer about your situation. Last reviewed October 2026.