The 45-day DROP cycle: a checklist

Each missed deletion can cost $200 per request per day, so the cycle is worth running the same way every time. The steps below follow CalPrivacy's DROP Technical and API Reference (version 1.2.0). Check the official documentation for the details your engineers need.

1. Choose your deletion lists

DROP offers 6 list types: NDZ, Email, Phone, MAID, NameVIN, CTVID. Brokers must select every list containing an identifier that corresponds to personal information in their own records; they may select fewer only if several lists would match exactly the same set of consumers.

Write down which lists you selected and why. That reasoning is the first thing an auditor will ask about.

2. Download the lists

You can use the DROP API or download from the data broker portal. After your first download and a completed upload, later downloads contain only identifiers that are new since the previous download, plus a separate file of requests consumers withdrew. Keep each file exactly as downloaded and record when you downloaded it.

3. Standardize and hash your own records

DROP never shares raw identifiers. You standardize your records with the published rules and hash them the same way: SHA-256 over UTF-8 standardized values, Base64 output. The DROP Sandbox includes a Standardization and Hashing Tool for checking your implementation against DROP's.

Small differences matter here. A ZIP code or name standardized differently produces a different hash, and a different hash means a missed match.

4. Match

Compare the hashes on your side with the hashes in each list. Note how you handle an identifier that points to more than one consumer in your records; it changes the status you report.

5. Act on every match

Delete the non-exempt personal information, or record why it is exempt. You must direct all service providers or contractors to process deletions and opt-outs based on the match outcomes.

6. Report a status for every request

Upload one status per work item. The codes are:

• 2: Exempted
• 3: Deleted
• 4: Opted out
• 5: Not found

7. Keep the evidence

Independent audits start January 1, 2028 and repeat every 3 years. For each cycle, keep the lists you selected, when you accessed DROP, the file hashes, the counts per status, and who approved the upload. A log that shows edits or gaps is worth more than a policy document.

How BrokerShield fits in

BrokerShield runs these steps on your machines: it pulls the lists, hashes your records with versioned rules, matches locally, prepares the status file for your approval, and writes every step to a signed, hash-chained log. Your consumer data never leaves your systems.