DROP is California's Delete Request and Opt-Out Platform, and all data broker deletion in California now runs through it. Drop45 standardizes, hashes, and matches CalPrivacy DROP deletion lists against your records — entirely in your browser. Consumer data never leaves your machine. Built to the official CalPrivacy technical spec.
Run a match now — free See ProThis is DROP for data brokers — the processing side. If you are a California resident who wants your own data deleted, use the state's free consumer platform at privacy.ca.gov/drop instead.
From Aug 1, 2026, every registered California data broker must pull DROP deletion requests at least every 45 days, match them against records, delete or opt out, and report a status for every request. It binds every firm on the California data broker registry — if data broker registration in California applies to you, so does DROP.
SB 362, the California Delete Act, sets fines at $200/day per unprocessed deletion request, plus CalPrivacy's investigation costs. One hundred missed requests is $20,000 a day.
Enterprise CCPA data broker compliance platforms handle DROP for $499+/mo — they are built for the large firms on the CCPA data broker registry. Small brokers — lead-gen firms, people-search sites, list managers — need the matching done, not a platform. That's Drop45.
One email a week: your next statutory pull-and-process deadlines and how many days remain. Computed from the SB 362 schedule. No spam — one-click unsubscribe.
Everything below runs locally in your browser (SHA-256 via WebCrypto). Your files are never uploaded. Free tier matches up to 500 of your records per run — Pro is unlimited and adds status files, suppression lists, and audit evidence.
Unmatched requests are reported as status 5 (not found) automatically.
Matched work items:
Sanity-check the standardization: type any email and see the exact standardized value and SHA-256/Base64 hash Drop45 produces per the CalPrivacy spec.
Sign in to the DROP broker portal and download your deletion lists (CSV per list type). Required at least every 45 days from Aug 1, 2026.
Drop45 standardizes your records exactly per the CalPrivacy spec (casing, accents, E.164-style phones, ZIP rules), hashes with SHA-256/Base64, and matches against the list — including composite NDZ and Name+VIN hashing.
Export the delete worklist for your database team, the Id,Status response file to upload back to DROP, a suppression list for ongoing screening, and a timestamped audit evidence report.
Try the full pipeline
A complete data broker deletion service for small brokers, every 45-day cycle
What DROP compliance platforms charge small brokers today
If you're a large broker with service-provider orchestration needs, an enterprise platform is the right call. If you need the 45-day cycle handled correctly, Drop45 does it.
No. Parsing, standardization, hashing, and matching run in your browser via the WebCrypto API. The only network call Drop45 ever makes is license verification (the key string only).
No — you download your deletion lists from the DROP broker portal (manual download is fully supported by CalPrivacy) and drop the CSV here. API-based auto-pull is on the roadmap for Pro.
All six DROP list types: Email, Phone, Mobile Ad ID, Connected TV ID, Name+DOB+ZIP (NDZ), and Name+VIN — including the composite hash-of-hashes construction for NDZ and Name+VIN.
Drop45 automates the matching and reporting mechanics. Actually deleting matched records from your systems (and directing your service providers to delete) is your obligation. Drop45 is software, not legal advice — consult counsel on exemptions.
Drop45 is an independent tool by a solo developer, part of a portfolio of small privacy and compliance tools. Questions? Use the contact page — we reply by email.
The Delete Request and Opt-Out Platform explained — what CalPrivacy publishes, what the 45-day cycle actually requires, and what you send back.
Who must register, the annual fee and deadline, and how registration decides whether DROP applies to you.
What the law requires of California data brokers from Aug 1, 2026, and how the $200/day penalty is calculated.