Updated 2026-09-25

The DROP API for data brokers: downloading the lists, building the response file, and amending it

DROP, the Delete Request and Opt-out Platform, is run by CalPrivacy (the California Privacy Protection Agency). Registered data brokers pull hashed consumer identifiers from it, match them against their own records, and upload a status for every record. The Data Broker API has three endpoints under https://api.drop.privacy.ca.gov: GET /data/download, POST /data/upload and POST /data/amend. This article covers each as documented in the state's technical specification, version 1.2.0. The API is optional; the portal also offers manual download and upload.

Getting an API key

You need a DROP account, completed registration where applicable, and paid fees. Then, in the Data Broker Portal: go to Home → Consumer Deletion Lists, select the lists your business will process, click Save, open the API Key tab, and click Get a new API key.

The key is scoped to the lists you selected; only those appear in your downloads. Every request carries it in the X-API-KEY header. Regenerate it if compromised or if your list selection changes; issuing a new key deactivates all previous keys.

The download

Call GET /data/download with X-API-KEY and Accept: application/zip, application/json. Three outcomes are documented for a valid key:

• 200 OK with Content-Type: application/zip and a Content-Disposition filename such as 20260312_4821_DROP.zip.
• 202 Accepted with a JSON message: the package is being prepared. Call again later.
• 200 OK with a JSON message: no new data.

Other codes: 401 (bad or missing key), 403 (not eligible, or no lists selected), 404 (wrong path), 429 (wait 30 seconds), 500 (retry later).

The ZIP holds one CSV per selected list type. Six exist: Email, Phone, MAID and CTVID are single-field hashes; NDZ (first name, last name, date of birth, ZIP) and NameVIN (first name, last name, VIN) are composite hashes. A list with nothing new arrives header-only. If previously delivered identifiers were removed, for example by a consumer cancelling, the ZIP also contains one Removed CSV.

Every deletion list row is Id,Hash:

Id,Hash
A7kP2xQ9Lm4R,KA18MT/ph6IHYjzT9zwETySDQyvSh87YuoSBpOQtkhE=

Id is the work item identifier: 12 case-sensitive Base62 characters, unique across all lists, and permanently tied to one work item. Hash is SHA-256 over the UTF-8 standardized identifier, Base64 encoded. The Removed file adds a ListType column. No response is required for empty files or removed identifiers. After the first download and completed upload, later downloads contain only new identifiers.

The response file

The response is a UTF-8 CSV with the exact header Id,Status. Each row is a work item Id from the download and one numeric status:

Codes 0 and 1 are unused. Any other value fails validation.

Name the file after the downloaded file it answers. The pattern is <YYYYMMDD>_<DataBrokerId>_<DataType>[_<OptionalSuffix>].csv, where DataBrokerId is your four-digit broker ID from the download. To send more than one file for the same list, add a suffix: an underscore and up to 10 alphanumeric characters, such as 20260312_4821_Email_part01.csv. Uploading the same name again without a suffix is an error.

Example response to 20260312_4821_Email.csv:

Id,Status
A7kP2xQ9Lm4R,2
bK8rT3nV6pZa,5
x92LmQ8Zp3Rt,4

Partial responses are allowed; send the rest later under the same base name with different suffixes. The upload is not complete until every outstanding record from the download has a status.

Uploading and what the state answers

POST /data/upload takes multipart/form-data with one or more CSVs in the field files, not a ZIP.

curl -X POST "https://api.drop.privacy.ca.gov/data/upload" \
  -H "accept: application/json" \
  -H "X-API-KEY: your-api-key-here" \
  -F "files=@20260312_4821_Email.csv;type=text/csv"

202 Accepted means at least one file was accepted and queued. 400 Bad Request means the request was malformed or no file was accepted. 401, 403, 404 and 429 behave as on download; 503 is temporary, retry later.

The JSON body lists message, acceptedCount, rejectedCount, accepted (each with fileName and fileSizeBytes) and rejected (each with fileName and message). Five file-level rejections are documented: no CSV provided, a non-CSV file, a header other than Id,Status, a file name already uploaded for the current download, and a file that is not readable as UTF-8 CSV.

A 202 is not a clean bill for the rows. Row-level validation continues after the response, and errors are emailed to the account's primary and secondary contacts; correct them and resubmit. DROP also sends Upload Confirmation and Upload Processed notices by email, or as HMAC-SHA256 signed upload.received and upload.processed webhooks if enabled in Notification settings.

Amendments

POST /data/amend accepts the same multipart request, file format and naming as /data/upload, and returns the same JSON. Only the purpose differs: corrections or updates to statuses you submitted previously. Each row is the original work item Id with the status you now assign. Amendments get their own notifications, Amendment Confirmation and Amendment Upload Processed, and the webhooks amendment.received and amendment.processed.

The specification does not say what happens if an already-reported Id is sent to /data/upload instead; /data/amend is the documented path for changing a reported status.

Sandbox and production

Production is https://api.drop.privacy.ca.gov; the sandbox is https://api.drop.privacy.ca.gov/sandbox. A sandbox key is issued separately in the portal under SANDBOX ENVIRONMENT → ISSUE SANDBOX API KEY. The sandbox also hosts a Standardization and Hashing Tool for checking your hashes against DROP's before production.

What DropClerk does

DropClerk downloads each cycle's lists, builds and uploads the Id,Status response files, and keeps the audit log of every request and response. The first cycle is free.

Sources

CalPrivacy, DROP for data brokers, technical specifications v1.2.0 (July 2, 2026):

• Getting Started
• Integration Workflow
• Working with the Data
• API Operations
• Reference