California DROP: what must data brokers in your vendor stack do?

What is California DROP and when did it start?

DROP, the Delete Request and Opt-out Platform, is California's one-stop deletion system for data brokers, created by the Delete Act (SB 362). California residents have been able to submit a single request through DROP since January 2026, and under Civil Code section 1798.99.86(c)(1), every registered data broker has had to access the platform and process those requests since August 1, 2026. The California Privacy Protection Agency, which now calls itself CalPrivacy, runs the platform and enforces the law.

If your firm buys prospect lists, appends data to its CRM or rents contact data for campaigns, this changes what you receive. One consumer request now reaches every registered broker at once, and those vendors remove California consumers from their files every 45 days.

Who counts as a data broker?

A data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom it does not have a direct relationship, under section 1798.99.80(c). Brokers must register with CalPrivacy by January 31 following each year they meet that definition, and CalPrivacy lists the current annual registration fee as $6,000.

The definition carves out entities to the extent they are covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, California's Insurance Information and Privacy Protection Act, or HIPAA-exempt processing. Those carve-outs are partial. A financial firm is outside the definition for the client data GLBA governs, and the vendors that sell it marketing or prospect data generally sit outside GLBA entirely. Our guide to the CCPA GLBA exemption explains where that line falls for the rest of the CCPA.

Business contact data is not automatically exempt either. A CCPA consumer is any California resident, and the CCPA's business-to-business and employee exemptions became inoperative on January 1, 2023 (the same change behind today's CCPA employee data obligations). A vendor that sells names, emails and phone numbers of California professionals it has no relationship with can fall within the definition.

What must a broker do with each DROP request?

Download the deletion list at least once every 45 days, match it against its own records, and act on every match within 45 days. CalPrivacy's processing guidance spells out the mechanics:

• Identifiers in DROP are hashed. Brokers standardize their own records and compare them against six lists: name with date of birth and ZIP code, email, phone, mobile advertising ID, name with VIN, and connected TV identifier.
• Where a request matches one consumer, the broker deletes all non-exempt personal information about that person, including inferences, and directs its service providers and contractors to delete matching records.
• Where an identifier is shared by several consumers, the broker opts all of them out of sale and sharing.
• Where nothing matches, the broker keeps the request on file and screens newly collected records against it before selling or sharing them.
• The broker reports a status for each request in DROP: deleted, opted out, exempted or not found.

The obligation continues after the first deletion. Under section 1798.99.86(d), a broker must keep deleting that consumer's personal information at least once every 45 days and may not sell or share new personal information about them unless the consumer asks otherwise or another CCPA exemption applies. A request the broker cannot verify must be treated as an opt-out of sale or sharing. Data a broker keeps under an exception may be used only for that purpose and never for marketing.

What are the penalties and audit requirements?

A registered broker that fails to delete as required faces an administrative fine of $200 for each deletion request for each day it fails to delete, under section 1798.99.82(d), plus CalPrivacy's investigation and enforcement costs. Failing to register carries a separate $200 per day fine. Because the deletion fine runs per request, a broker that ignores a large DROP list faces exposure that grows by the day.

Starting January 1, 2028, and every three years after, each broker must undergo an independent third-party audit of its DROP compliance under section 1798.99.86(e). The broker must give the audit report to CalPrivacy within five business days of a written request and keep it for at least six years. From 2029, registration must disclose whether the broker has been audited.

What does this mean for a firm that buys data?

Expect fewer California records and plan for the gap. Every list, append or enrichment feed from a registered broker now excludes consumers who used DROP, and the exclusions grow each cycle. Copies you exported months ago still contain those people, and reusing an old export puts your campaign out of step with the vendor's current file.

The statute directs deletion to the broker's own service providers and contractors. It is silent on third parties that already bought the data, so your contract is where you set the rule for refreshes and suppression. Firms that resell or share data about people they do not know should also look at their own status. The definition turns on what a business does with the data.

What should your firm do this quarter?

• List every vendor that supplies personal information about people your firm has no relationship with: prospect lists, data appends, intent data, people-search and enrichment tools.
• Check each one against CalPrivacy's data broker registry and ask unregistered vendors why they believe they are exempt.
• Ask registered vendors how often they process DROP lists and how suppression flows into the files and feeds you receive.
• Update contracts to require current files, prompt suppression and deletion of stale copies on your side.
• Find old exported lists in shared drives, mailboxes and marketing tools, and delete the ones past their refresh date.
• If your firm sells or shares personal information about people it does not have a relationship with, ask counsel whether the Delete Act applies to you.

How does s90 help?

s90 helps firms in Los Angeles and Orange County find where purchased and exported personal information lives across Microsoft 365, file shares and SaaS tools, so stale lists get cleaned up and vendor data stays inside the systems you control. Our CCPA work maps those data flows alongside your other obligations, and our agreements include 72-hour breach notification and 24-hour evidence production. Talk to s90 about your data inventory.