Updated 2026-09-25

How DROP hashes identifiers: the standardization rules, with worked examples

California's DROP (Delete Request and Opt-out Platform) delivers consumer deletion requests to registered data brokers as hashed identifiers; there is no option to download raw values. To match a list against your own records, you standardize each identifier the way the state does, hash it the same way, and compare. Any deviation in standardization produces a hash that never matches.

This article works through the rules in the state's technical specification, version 1.2.0 (July 2, 2026). Every hash shown was recomputed with DropClerk's hash library, which is tested against the 18 worked examples the state publishes.

The pipeline

Every field goes through the same four steps: apply the identifier-specific standardization, encode the result as UTF-8, hash it with SHA-256, and encode the 32-byte digest as Base64. A SHA-256 digest in standard Base64 is always 44 characters and ends in a single =.

DROP has six list types. Four are single-field hashes: Email, Phone, MAID and CTVID. Two are composite hashes, NDZ and NameVIN, where each field is hashed on its own, the Base64 strings are concatenated in a fixed order, and the concatenation is hashed again.

Email

Remove whitespace and convert to lowercase. Do not remove dots, plus signs or any other characters.

Common mistake: applying Gmail-style normalization, such as stripping dots or a +tag. The spec says not to. annasmith@domain.com hashes to CnBwE8DSaBGBi1vyPXAhjiEP1lqghw0auMPWgeIJce8=, which will not match.

Phone

Strip every non-numeric character, then keep the last 10 digits. If fewer than 10 digits are present, keep them all.

Common mistake: keeping the country code. 14155559317 hashes to XIPRAOBijcVnkOZummaTWiQg55LkJ5vPCZ54j5+jYks=. The last-10-digits rule applies to every number regardless of country: the spec's own example turns +84(90)123 4567 into 4901234567.

Mobile advertising ID (MAID)

Keep only hexadecimal characters (0-9, a-f) and convert to lowercase. The standardized value must be 32 characters.

Common mistake: hashing the UUID form with its hyphens, which gives Stwc1bCPnkQSTKlMj3WY3weXuck5FFt9/X3q+IaOBKY=.

Connected TV ID (CTVID)

Keep only alphanumeric characters and convert to lowercase. The standardized value must be between 8 and 32 characters.

Common mistake: removing the underscore but leaving the case. SmartTV9F8E7D6C hashes to rfh7aL0r1T139j4tdcij7uBmb29lbgS35hvXVYqwRAo=.

Name, date of birth and ZIP (NDZ)

NDZ is a composite, so three field types each have their own rules.

Name. First and last name are separate fields, standardized and hashed separately. Lowercase. Replace accented Latin characters with plain ASCII (å is a, ö is o, ñ is n). Replace the special Latin letters in the spec's table (ß is ss, æ is ae, œ is oe, ø is o, ł is l). Transliterate Greek and Cyrillic using the DROP Transliteration Mapping published in the spec. Leave Chinese, Japanese, Korean, Arabic and Hebrew characters unchanged. Then remove hyphens, apostrophes, spaces, punctuation, symbols and every other non-letter, non-digit character. Compound first names are one unit: Juan Pablo becomes juanpablo.

Date of birth. YYYYMMDD with a four-digit year. July 4, 1985 is 19850704.

ZIP. Keep alphanumeric characters only, drop the +4, lowercase, remove leading zeros, and take the first five characters. The spec's examples: 91790-3771 is 91790, 00300-9999 is 300, 00712345 is 71234, and the Canadian M1B 1A1 is m1b1a.

Then hash each field, concatenate the four Base64 strings in the order first name, last name, DOB, ZIP, keeping the = padding, and hash the concatenation.

Worked example: Danielle Johnson, born July 4, 1985, ZIP 91790.

Concatenated string (176 characters):

5dUD1FgiKcTJq+JQ5JZUdlyIXrSbtJ338YYbt5/HNG4=K+TjOqPiH2/3rRRPj9WCKKHM47UDQLSAX/DGNIDuxIg=IWi7qxOAbBJe0fNciDj76Eg84gmj40rB7aNMK/VnFOI=2FPZucR4x7U8KlM+SFAX4LPGhwNz/PIZUCSUdDh0o/s=

Final hash: PQOfn1RffEKmqMmNAzDKKaoZCwxWbQZkQzPWmQo9REA=

Common mistakes: concatenating the standardized strings instead of their hashes (daniellejohnson1985070491790 gives 8tkCeAYmqK6jqnAOuVNFVSTTKB6BoceGJeTBXJvngPE=); stripping the = padding from the four hashes before concatenating (HyBikPFcWOdpFoVRQ/mlaGRunI87AlzIB5BWqKmMj6s=); and keeping leading zeros in the ZIP (00300 gives LXUTxgeTx4kAXzQb/0FsA8ACDigpdXcniISqedW0Vao= instead of the hash of 300).

Name and VIN (NameVIN)

Names follow the rules above. For the VIN, keep only alphanumeric characters and convert to lowercase; the result is 17 characters. Hash the three fields, concatenate in the order first name, last name, VIN, and hash again.

Worked example: Eve Genesis, VIN 1HGCM82633A004352.

Concatenated string:

hSYq33RRi7twx8uUzWFZ2RZp5age3x7+vVQ+rb2p+is=ruutSnlvzC4V3ExgYbRe2bNz8mrfx5jKfS2MxYGCcY4=iNswy1m+0VSt8jAfFrvaiQ1R/0HAbgSwNGkwqo6QBss=

Final hash: rtnDuXIe63jXYQQXW5r07GJ7lSsrib8+46QuKFwkOmk=

Common mistake: hashing the VIN in uppercase. VINs are conventionally written in capitals, so the lowercase step is the one most often skipped.

Checking your implementation

First, compare hashes with the padding normalized: the spec's own CSV examples show the same email hash once with its trailing = and once without, so do not assume the delivered value will always carry the padding. Second, the free verifier at dropclerk.com/verify runs the same rules in your browser, re-runs the state's 18 published examples when the page loads, and lets you hash a value of your own to compare against whatever you produce today. The state's DROP Sandbox also offers a Standardization and Hashing Tool.

What DropClerk does

DropClerk downloads the state's hashed lists with your API key, and your browser standardizes and hashes your records and matches them against those lists, so no record or hash of a record reaches our server. A production registration runs its first full cycle free.

Sources

• California Privacy Protection Agency, DROP technical specification v1.2.0, "Working with the data": https://privacy.ca.gov/drop-for-data-brokers/technical-specifications/working-with-data/
• DROP technical specification, "Reference" (glossary, version history): https://privacy.ca.gov/drop-for-data-brokers/technical-specifications/reference/
• DROP technical specification, "Getting started", under https://privacy.ca.gov/drop-for-data-brokers/
• DropClerk verifier: https://dropclerk.com/verify/