What the law requires
Once the request lands, the work is yours.
DROP — California’s Delete Request and Opt-out Platform — is the state website where a resident files one request for covered registered data brokers to process. The required result can be deletion or an opt-out, subject to the statute’s verification, purpose, and exception rules. The state hands you the list; it doesn’t do the work inside your company.
DROP Matched sits between the state’s list and the answer you send back — it does the matching; your team does the rest.
-
The request
One request reaches every registered broker
A resident files once on DROP. The request reaches the registered data brokers covered by the state workflow and stays active going forward, so new requests keep arriving. Registry counts change; your own registration and DROP account control which requests you must process.
-
The clock
A rolling 45-day clock, from Aug 1, 2026
Starting August 1, 2026, each broker must access DROP on its own rolling clock — at least once every 45 days from its last download — act on each request, and report the outcome. It is not one shared calendar; every broker runs its own.
-
The stakes
$200 per request, per day
California law authorizes an administrative fine of $200 for each deletion request for each day a broker fails to delete information as required by the DROP statute, plus reasonable enforcement expenses. Exceptions and the facts of a request still matter.
The request file is where your work starts, not where it ends.
