If your business is a registered California data broker, or you advise one, mark your calendar: August 1, 2026 is the day the Delete Act stops being a registration exercise and becomes an engineering deadline. Beginning on that date, every registered data broker must log into California's new Delete Request and Opt-out Platform ("DROP") at least once every 45 days, pull the state's list of consumer deletion requests, and actually delete the matching data. The good news? The California Privacy Protection Agency ("CPPA," now operating its consumer-facing services under the "CalPrivacy" banner) has published a straightforward API and technical specification that lets brokers automate nearly all of it. This post walks through what the law requires and how the API works, from authentication to hashed matching to status reporting.
What Is the Delete Act?
The Delete Act (SB 362, codified at California Civil Code §§ 1798.99.80–1798.99.89) is California's answer to a stubborn problem with the CCPA: consumers technically had the right to request deletion from data brokers, but exercising it meant sending individual requests to hundreds of companies. The Delete Act allows California residents to place a single, free, verifiable deletion request that reaches every registered data broker in the state at once.
What Is a Data Broker under the Delete Act?
The statute defines a data broker as "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship" (Cal. Civ. Code § 1798.99.80). The CPPA website notes that data brokers are businesses that gather consumer data like precise geolocation, browsing history, shopping habits, interests, or health information, that the consumer didn't give them directly, make inferences also considered personal information, and then package, trade and sell that information to various organizations. For example, music-streaming services may collect your playlists, grocery stores or clothing retailers may collect your purchase history, video streaming services may collect your viewing history. Who is buying this information? Advertisers, employers, recruiters, political campaigns, debt collectors, and landlords are known buyers. Sometimes malicious actors like hate groups and scammers can be buyers.
Entities already regulated under the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, California's Insurance Information and Privacy Protection Act, and certain entities subject to California's Confidentiality of Medical Information Act are excluded from the data broker requirements under the Delete Act. Certain information such as public records, vehicle or real estate ownership, voting records and responses to criminal or civil investigation will also remain public.
Information collected directly from consumers when consumers sign up for an app, buy something or register for a newsletter does not have to be deleted through the DROP system. Data brokers must delete information they got from other sources, but not information provided by consumers directly. That said, California consumers can request that direct information be deleted in a privacy request.
Businesses meeting the definition of a data broker must: (i) register with CalPrivacy by January 31, of each year following the year they qualify and pay the registration fee; (ii) process deletion requests submitted through the DROP system; (iii) report the types of information they collect and share (including whether they handle government ID numbers, precise geolocation, biometric data, or reproductive health data, and whether they share data with foreign actors, governments, law enforcement, or developers of generative AI systems); and (iv) undergo audits to ensure they're following the Delete Act. Data brokers must register if they operated as a data broker in 2025, started brokering the data of California residents between January 1 and August 1, 2026, or plan to begin operating as a data broker after August 1, 2026.
Meet DROP
Section 1798.99.86 required the CPPA to build an "accessible deletion mechanism." The DROP system is that mechanism: privacy.ca.gov/drop. Any California resident (or their authorized agent) can submit one verifiable request, and can even selectively exclude specific brokers they want to keep a relationship with. Data brokers are required to access DROP to process deletion requests beginning on August 1, 2026.
For brokers, the platform does not send brokers raw consumer data. Instead, it publishes lists of hashed identifiers (cryptographic fingerprints of email addresses, phone numbers, and other identifiers) that brokers download, match against their own (identically hashed) records, and act on. Consumers' identifying details are never exposed to brokers who don't already have them.
One more obligation deserves emphasis: deletion is not a one-time event. Once a consumer's request is processed, the broker must continue deleting that consumer's personal information at least once every 45 days going forward (§ 1798.99.86(d)), which is why maintaining an internal suppression list is effectively mandatory. Brokers must also direct their service providers and contractors to delete matching records.
How the DROP API Works
Brokers can process DROP requests manually through the portal, but manual processing and reporting may not be feasible for any business handling data at scale.
Luckily, CalPrivacy, which runs the DROP system, has set up an API (application programming interface) that lets data brokers automatically retrieve the California deletion-request lists and file back their compliance responses. Its operation is fairly simple: it's a REST API with three endpoints, the data format is plain CSV, and the agency publishes an OpenAPI specification plus a full sandbox environment for testing before you touch production data.
Before writing any code, a broker needs to create an account on the DROP site, complete registration, and pay any required fees. From the Data Broker Portal, you can then select the consumer deletion lists that correspond to the identifier types you actually hold and generate an API key from the API Key tab. Every request authenticates with that key in an X-API-KEY header over HTTPS (TLS 1.2 or higher). Two base URLs are available: https://api.drop.privacy.ca.gov for production and the same host with a /sandbox path for testing. Don't forget that standard security hygiene applies: store the key in a secrets manager, never in source code, and regenerate it immediately if it's compromised or if your list selections change.
The Cycle of Compliance
The CPPA describes the integration as "an ongoing pull-process-respond cycle, not a one-time integration." That sounds like a burden, but the API is what makes it manageable: once a broker sets up the cycle, it runs automatically on a schedule, at least every 45 days. Human involvement shifts from processing requests manually to monitoring that the system ran cleanly, including watching for DROP's error notification emails.
Each cycle has four steps:
1. Download. Your system asks DROP for the latest deletion lists and receives a ZIP file of simple spreadsheets, one for each list type you have selected. DROP offers six list types matching the identifiers brokers commonly hold:
| List | Identifier | Hash type |
|---|---|---|
| NDZ | First name + last name + date of birth + ZIP | Composite hash |
| Email address | Single-field hash | |
| Phone | Phone number | Single-field hash |
| MAID | Mobile advertising ID | Single-field hash |
| NameVIN | First name + last name + VIN | Composite hash |
| CTVID | Connected TV identifier | Single-field hash |
2. Standardize and hash. The lists do not contain readable personal information. Instead, each identifier appears as a "hash," which works like a scrambled fingerprint. Your system converts your own records into the same kind of fingerprints by following the CPPA's exact formatting rules, which are published with worked examples in the "Working with Data" specification. Because both sides follow identical rules, the fingerprints can be compared automatically. Consumers' details are never exposed to brokers who do not already have them.
3. Match and act. Where the fingerprints match, your system flags the record. All non-exempt personal information must be deleted, and your service providers must be told to delete it too. If a request cannot be verified against your records, you treat it as an opt-out of sale instead. Matched fingerprints also go on a suppression list, so any data you acquire later is screened automatically.
4. Report. Your system sends DROP a response file reporting what happened to each record, using one of four status codes. There is also a way to correct a response you already submitted. Then the cycle repeats.
| Code | Label | Meaning |
|---|---|---|
| 2 | Exempted | Match found, but the personal information is exempt from deletion |
| 3 | Deleted | Match found and all non-exempt personal information was deleted |
| 4 | Opted out | Several consumers share the same identifier, so all were opted out of sale |
| 5 | Not found | No match found in the broker's records |
Building a Defensible Integration
The API itself is simple. What regulators will scrutinize is the compliance record it generates. A few practices separate a defensible program from a risky one:
- Test in the sandbox first. The CPPA provides a practice environment where mistakes have no consequences. Use it before working with real data.
- Log everything. It is easy to have your system automatically record every download, match, and upload. Those records become your evidence for the third-party audits that begin in 2028.
- Build in error handling. The CPPA's instructions tell your system exactly what to do when something goes wrong, so most problems can be handled automatically instead of by a person watching a screen.
- Watch your inbox after uploads. If individual records have errors, DROP flags them in a follow-up email. A successful upload is not always a clean one.
- Have a manual fallback plan. If the automated connection breaks, you must notify CalPrivacy in writing within 45 days. Manual processing through the DROP website remains available while you fix it.
The Cost of Getting It Wrong
The Delete Act's penalty structure is built to make procrastination expensive. Failing to register carries administrative fines of $200 per day. More pointedly for DROP compliance, failing to process deletion requests carries fines of $200 per day for each deletion request left unprocessed. The CPPA can also recover unpaid registration fees and its investigation costs.
The Compliance Calendar
Four dates matter, and two of them have already passed:
January 1, 2026 - DROP opened to consumers. Deletion requests have been accumulating in the platform since then.
January 31, 2026 - Annual registration deadline for brokers who met the definition in 2025 (this deadline recurs every year).
August 1, 2026 - Brokers must begin accessing DROP at least once every 45 days, processing all pending deletion requests, and reporting outcomes within 45 days of receipt (§ 1798.99.86(c)). Requests that cannot be verified must be processed as opt-outs of sale under Civil Code § 1798.120.
January 1, 2028 - Independent third-party compliance audits begin, recurring every three years. Brokers must produce audit reports to the CPPA within five business days of a request and keep audit records for six years.
If you're unsure whether your business qualifies as a data broker, or you want help getting your DROP compliance program up and running before August 1, reach out to us at info@abusselaw.com.