DROP guides

What the state's Delete Request and Opt-out Platform asks of a registered data broker, from the regulation and the technical spec.

• The DROP 45-day cycle: what California expects from a data broker, and when

  The two 45-day duties in California's DROP regulation, where the clock starts, the 2026 window dates, and what one cycle consists of.

• The DROP API for data brokers: downloading the lists, building the response file, and amending it

  What the state's DROP API gives a data broker, the exact Id,Status response file format and naming, the status values, what the state answers on upload, and how an amendment is handled.

• What to keep as your DROP audit record

  What the Delete Act and the DROP regulation actually require a data broker to keep, what a reviewer would plausibly ask for, a per-cycle checklist, and the rule on third parties acting for you.

• How DROP hashes identifiers: the standardization rules, with worked examples

  Standardization and SHA-256 hashing for each DROP identifier type, with worked examples computed from the state's published test vectors, and the mistakes that break a match.