DropClerk

Updated 2026-09-25

The DROP 45-day cycle: what California expects from a data broker, and when

If you are a registered California data broker, the Delete Request and Opt-out Platform (DROP) puts you on a repeating clock. This article covers what the regulation requires, where the 45 days start, and the 2026 calendar. It draws only on the regulation text (11 CCR § 7600 et seq.) and the state's DROP pages, and says so where a date is derived rather than stated.

The two obligations in the regulation

The regulation sets two duties that both run on 45-day periods.

Access. Under § 7612(a), you must access DROP to download your selected consumer deletion list(s) "at least once every 45 calendar days." You may do this manually in the Data Broker Portal or through the API (§ 7612(b)). If your automated connection cannot download in time for any reason, you must download manually instead. If the connection failed and it was not your error, you must also notify the Agency in writing through your DROP account within 45 calendar days of your last access (§ 7612(b)(1)).

Report. Under § 7614(a), after your first access you must, "at each subsequent access session, report the status of every deletion request received during the previous access session." Each request gets one of four codes: record deleted, record opted out of sale, record exempted, or record not found (§ 7614(b)(2)). If you upload manually, you must report the previous session's statuses before you download a new list (§ 7614(c)(1)).

The state's process page puts the same thing in plainer terms: the cycle starts when you download a list, you then have up to 45 days to complete the cycle, and completing it includes downloading the next list. You may download more often than every 45 days if you want to.

Where the clock starts

Nothing in the regulation names a calendar date. The August 1, 2026 start comes from the Delete Act itself (Civil Code § 1798.99.86(c), as cited on cppa.ca.gov), and the state's guidance is: "Starting August 1, you have 45 days to access DROP and process your first batch of deletion requests."

After that, the clock is yours. Each download starts a new 45-day period, so your deadlines depend on when you actually pulled your lists, not on a state-wide schedule.

The 2026 windows

Counting 45 days from August 1 gives September 15. The table continues the count on the assumption that a broker downloads on the last permitted day each time. Only the first date is one the state has stated; the later two are arithmetic.

Window Latest download date Basis
First batch September 15, 2026 Stated by the state: 45 days from August 1
Second October 30, 2026 Derived: September 15 + 45 days
Third December 14, 2026 Derived: October 30 + 45 days

If you downloaded earlier than September 15, your next deadline is earlier too: 45 calendar days from your own last download.

What a cycle consists of

Within each access session you download a ZIP with one CSV per selected list (§ 7613(a); technical specifications). After the first download, each later download contains only requests received since your most recent download (§ 7612(c)). You can ask the Agency in writing, through your account, for a complete re-download when you need it for reconciliation or your audit (§ 7612(c)(1)).

You then standardize and hash your own records the way the state specifies, compare them against the hashed identifiers, delete or opt out matched consumers as the statute requires (§ 7613), direct your service providers and contractors to do the same (§ 7613(d)), and upload an Id,Status CSV for every work item. The API accepts partial uploads, but your upload is not considered complete until every outstanding record from the download has been reported.

Records you reported as "not found" do not drop off. You must keep the deletion list and compare newly collected records against it before selling or sharing (§ 7613(c)). If a later match appears, you report the changed status at the next access session (§ 7614(a)(1)).

Other 45-day rules worth knowing

  • You may change your consumer deletion list selection only once every 45 calendar days (§ 7610(a)(3)(C)), and you must add any newly relevant list before your next access.
  • A business that begins operating as a data broker after the registration period must begin accessing DROP within 45 calendar days of commencing operation (§ 7611(a)(2)).
  • A business that stops being a data broker must notify the Agency within 45 calendar days (§ 7615(a)(1)).

What the regulation does not say

It does not give a fixed calendar of due dates beyond the statutory August 1 start. It does not say what happens to your clock if you download but do not finish reporting; the state's page says only that reporting is due within 45 days of the download. Keep your own download dates; they are the record that matters.

What DropClerk does

DropClerk runs the cycle for a registered broker: it downloads your lists, hashes and matches your records in the browser, and uploads the status file, with the next due date shown from your last download. The first cycle is free.

Sources