What is the California DROP system?
tl;dr
What it is: DROP is California's state-run deletion database. Registered data brokers must pull it and honor consumers' opt-out and delete requests at least every 45 days.
When: Production goes live August 1, 2026, and 300,000+ Californians have already signed up.
The fines: $200/day per consumer, representing over $60M/day in potential exposure, and climbing.
Overview
Before his presidential run, Gavin Newsom signed the California Delete Act (SB 362) back in October 2023.
In October 2025, California followed up with SB 361, the Defending Californians' Data Act.
Together they shape the rules & regs that go live for data brokers on August 1, 2026.
The law requires a few things:
Data Brokers have to register annually with CalPrivacy (a.k.a California Privacy Protection Agency)
Starting 2028, Data Brokers have to undergo an independent audit on Delete Act compliance
The CPPA has to build an "accessible deletion mechanism" (now called DROP) that Data Brokers have to integrate with
So what is DROP? Who needs to use it? And how do you comply?
What is California's DROP system?
The Delete Request and Opt-Out Platform (better known as "DROP") is basically a database of opt-out requests from California residents maintained by the state of California.
California residents can sign up and request that Data Brokers stop selling their data or delete it entirely, and Data Brokers have to create an account and process all those requests at least every 45 days.
When is DROP going live?
DROP went live for Californians on January 1, 2026. CalPrivacy reported over 300,000 signups by early June 2026 with more Californians signing up every day.
DROP sandbox opened in April 2026 so brokers can test their integrations.
DROP Production goes live August 1, 2026.
Who needs to sign up for DROP?
Any company considered a Data Broker under the California Delete Act needs to make an account with DROP and honor DROP requests.
A Data Broker has a specific legal definition! It's not exactly what most people would think of when they think "Data Broker"!
Heads up: Even Data Brokers that aren’t yet registered in CA still have to integrate with DROP and process requests, and then register normally in January 2027 (per CalPrivacy).
What is the definition of a Data Broker?
According to the California Delete Act a Data Broker is:
"a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship."
Like the CCPA, there are carveouts for businesses already regulated by some federal privacy laws like HIPAA, GLBA, and FCRA and for businesses under $25M revenue with data on less than 100,000 Californians who don't make most of their money selling data.
What does DROP cost?
If you've already registered as a Data Broker with the CPPA in January (costs $6,000 + cc processing fees), then good news! There's no extra charge!
In the case where you didn't register as a Data Broker but you still need to access DROP, it will cost $6,000 (plus cc fees), prorated monthly (so half off if you sign up 6 months into the year).
Isn't giving Data Brokers a list of people a privacy risk?
Yes! That's why the CPPA is developing a sophisticated way of sharing an anonymized list with Data Brokers. Different Data Brokers will get different lists depending on what information the Data Broker needs to find the consumer in their own databases (email address, phone number, mobile advertising ID, connected TV ID, or concatenated combinations like name+DOB+ZIP or name+VIN)
The CPPA will also hash the data before giving it to the Data Brokers, so at least theoretically the Data Brokers can only tell who's on the list if they're also in their own database.
How often does a Data Broker need to check DROP?
Data Brokers are required to pull the latest list, process requests, and report back to CalPrivacy at least every 45 days.
How will California know if a Data Broker is using DROP?
After a Data Broker pulls the list from DROP, they are supposed to report back to the CPPA to acknowledge who from the list was matched in their database.
How will DROP technically work?
The full technical spec was released by CalPrivacy on April 7, 2026, and the DROP sandbox has been open for testing ever since (see Superset's DROP API technical reference for the consolidated documentation).
Step 1 - Log in to the DROP portal (https://privacy.ca.gov/drop-for-data-brokers/) and report to CalPrivacy all the lists you could possibly match records against.
DROP defines six identifier lists that brokers can subscribe to:
EMAIL. Email address.
PHONE. Phone number.
MAID. Mobile advertising ID.
CTVID. Connected TV ID.
NDZ. First name, last name, date of birth, and ZIP, combined.
NVIN. First name, last name, and vehicle ID number, combined.
Step 2 - Normalize all the identifiers you have to match the format CalPrivacy provides (lowercase, strip whitespace, transliterate accented characters, etc.).
Step 3 - Hash those normalized identifiers with SHA-256 (it’s a good idea to save these in your DB)
If you are matching against a concatenated list (NDZ or NVIN), you have to append those hashed identifiers together and re-hash it again, e.g. SHA-256 (hashed first name + hashed last name + hashed DoB + hashed ZIP)
Step 4 - Download the lists of DROP subscribers. This can be done as a .zip file on the DROP portal, via DROP API, and via the Superset DROP Manager.
Step 5 - Compare both lists and treat any matches as an opt-out Data Subject Request.
Step 6 - Match your records against the DROP lists, process the requests, and report back with CalPrivacy’s specific status codes:
(5) No match found - no processing needed
(4) Multiple records match - Treat request as an Opt-out of sale/sharing for all matching Data Subjects
(3) Exactly one record matches - Treat request as a Delete/Erasure for matching Data Subject
(2) Match is legally exempt
Step 7 - Return the response codes to CalPrivacy the same way you got the lists in Step 4
Step 8 - Repeat at least every 45 days (pro-tip: don’t wait that long so you have time to fix things if your process breaks)
Step 9 - Keep all records of lists/matches/reporting for at least 5 years.
Step 10 - Get an audit of this process before Jan 2028. CalPrivacy will be asking for it.
If this sounds like a lot, reach out to us at Superset. We’re the only Privacy software built for Data Brokers specifically and we’re always happy to get on a call and help.
What is the DROP Sandbox?
Ahead of the Aug 1, 2026 go-live date for DROP, CalPrivacy released a Sandbox environment for DROP, so Data Brokers can test their downloading, normalization, hashing, and reporting.
The DROP Sandbox is available via the DROP portal (https://privacy.ca.gov/drop-for-data-brokers/).
How does the DROP Sandbox work?
DROP is all about matching data, so how can you test it if you don’t know what data in the lists should match?
To address this issue, the Sandbox lists match against a synthetic dataset of 1,000 fake consumers provided by CalPrivacy as a .csv file.
That way Data Brokers can test their normalization and hashing processes against a list of consumers that they know will be matched in the lists that DROP Sandbox provides.
In fact once you report your matching results back to the DROP Sandbox, CalPrivacy will give you a report of any incorrect matches so you can know for sure your process is correct before graduating to Production DROP.
How is California enforcing this?
The fines for non-compliance with DROP are historic. We’ve never seen a fine schedule like this anywhere in the world before.
$200 per day PER CONSUMER for failure to delete a consumer's information (plus enforcement costs)
With over 300,000 Data Subjects already registered as of early June, 2026, that equates to over $60,000,000 PER DAY in fines. And that number is likely to climb higher as more Californians register.
CalPrivacy has already said unregistered Data Brokers are a top priority, so this is incredibly ready to go live.
Who is Superset?
Superset is a tech platform that specializes in Data Broker compliance.
We help Data Brokers stay on top of compliance with DROP, State Registrations, Privacy Inbox Management, and more.
Want to see it in action? Our DROP solution, https://ai.trustsuperset.com/drop, is open and the sandbox is free to click around.