The 45-day deletion cycle, run for you — every cycle, on the record.
California's Delete Act puts every data broker on a clock that never stops: pull the state's DROP deletion lists at least every 45 days, match them against your records, act on every request, and report a status for each one. Miss, and the fine runs at $200 per unprocessed request, per day. The DROP Cycle Desk runs that cycle for small brokers — registration readiness, the matching itself, and the evidence file your 2028 audit will ask for. You stay the registered broker; we are your operations desk, under a data processing agreement. This is an operations service, not legal advice.
Operations only · Your DROP account and your API key · Not legal advice
The clock, at a glance
Statute: California Civil Code § 1798.99.80 et seq. (the Delete Act).
If you sell data about people you don't serve, this duty is yours.
You meet the definition
A data broker is a business that knowingly collects and sells to third parties the personal information of consumers it has no direct relationship with — lead generators, people-search sites, list brokers, data-append and enrichment shops. Whether you meet the definition is a legal determination; if you do, the duties on this page are not optional.
You're not in California — and it still applies
The duty follows the consumer, not your office. If your files hold California residents' personal information, you register with California and run the cycle, wherever your business sits. Most of the 600-plus brokers on the state registry are not California companies.
California is the anchor, not the whole map
Texas, Oregon and Vermont run their own broker registries today. Connecticut's opens January 1, 2027; New Jersey has enacted one. A broker's real obligation is a stack of registries plus California's recurring cycle — this desk tracks the whole stack, not just the loudest line in it.
You're small, and the math is not
The registration fee alone is $6,000 a year. The Agency's published orders so far are against firms the size of yours, not the platforms — the fine table is below. A five-person firm does not need a compliance department; it needs the cycle run, correctly, forever.
Five steps, every 45 days. Thirty, from January.
STEP 1 · PULL
Download the lists
From your own DROP account, with your own API key: a ZIP of CSV files, one per list type you process. The state never sends raw identifiers — every value is a SHA-256 hash.
STEP 2 · MATCH
Standardize, hash, compare
Your records are standardized to the CalPrivacy rules — names folded and stripped, phones to the last ten digits, emails lowercased and nothing more — hashed the same way, and compared hash to hash.
STEP 3 · ACT & REPORT
A status for every request
Each request ends in exactly one disposition — Deleted, Opted out, Exempted, or Not found — and the status file goes back under the same file name it arrived with. Then the evidence log closes the cycle.
| List | Identifier | How it is hashed |
|---|---|---|
| Email address | Single hash — trimmed and lowercased, nothing removed | |
| Phone | Phone number | Single hash — last ten digits |
| MAID | Mobile advertising ID | Single hash — hexadecimal characters, lowercased |
| CTVID | Connected TV identifier | Single hash — alphanumeric, lowercased |
| NDZ | First name + last name + date of birth + ZIP | Each field hashed, the hashes concatenated in order, the result hashed again |
| NameVIN | First name + last name + vehicle VIN | Same composite method, three fields |
Per CalPrivacy's DROP Technical and API Reference Documentation. The matching is unforgiving by design: standardize a field one character differently and its hash will never match — a request you never see is a request you never processed.
The cycle, run. The evidence, kept.
Before January
Registration Readiness
- Your obligation map: which registries, which lists, which deadlines — from your facts
- Registration answers prepared for the January 1–31 window; you review and submit
- Your DROP account and lists configured, your API key in place, first cycle run
Every cycle
Cycle operations
- Lists pulled on schedule — every 45 days, every 30 from January 1, 2027
- Standardization and matching to the CalPrivacy spec, tested against the state's published examples
- A disposition for every request, and the status file uploaded in the required format
Between cycles
Suppression screening
- The request hashes are kept as your suppression file, as the guidance expects
- New lists you buy or build are screened against it before you use them
- Multi-state registry changes tracked — Connecticut opens January 1, 2027
Always
The evidence file
- Every cycle logged: lists pulled, requests processed, dispositions, response files sent — timestamped and tamper-evident
- From January 1, 2028, independent auditors examine exactly this record
- The file is yours, exportable at any time — leaving us never strands it
The Agency is already collecting.
These are the California Privacy Protection Agency's published enforcement orders under the Delete Act, as of November 2026. We add each new order as the Agency publishes it. The pattern to notice: these are ordinary small and mid-size data firms — the segment the registration and cycle duties were always going to reach first.
| Firm | Fine | What happened | Source |
|---|---|---|---|
| LocateSmarter, LLC | $116,490 | CPPA enforcement order under the Delete Act | California Privacy Protection Agency — published enforcement order |
| Cybba, Inc. | $52,400 | CPPA enforcement order under the Delete Act | California Privacy Protection Agency — published enforcement order |
| Growbots, Inc. | $35,400 | Failed to register as a data broker | California Privacy Protection Agency — published enforcement order |
| UpLead, LLC | $34,400 | Registered late | California Privacy Protection Agency — published enforcement order |
The statutory rate behind these outcomes: $200 per unprocessed deletion request, per day, and $200 per day for failure to register (Civil Code § 1798.99.82). Orders: California Privacy Protection Agency — Information for Data Brokers.
Fixed prices, published on purpose.
This desk is a fixed product, not a scoped proposal — so its price sits on the page, in US dollars, where you can hold us to it. The price is confirmed in writing in your engagement letter before any work starts, and it does not change mid-cycle.
Start here · One-time
Registration Readiness
US$750 one-time setup
- Your obligation map — registries, lists, deadlines — from your facts
- Registration answers prepared for the January 1–31 window; you review and submit
- DROP account and consumer deletion lists configured; your API key in place
- Your first cycle run end to end, and your evidence log started
The desk · Ongoing
DROP Cycle, Done-For-You
US$490 per month
- Every cycle pulled, matched and reported on schedule — 45 days, 30 from January 1, 2027
- A disposition for every request, status files in the required format
- Suppression screening of the new lists you buy or build, before you use them
- Multi-state registry tracking — Texas, Oregon, Vermont, Connecticut from January 2027
- The evidence file maintained cycle over cycle — your 2028 audit record
Prices in US dollars. Set against the alternatives: the state charges $6,000 a year just to register, a single unprocessed request accrues $200 a day, and the published fines above start at $34,400.
What we never do.
We never register as you
Registration is the broker's own legal act, in the broker's own DROP account. We prepare everything behind it — the account stays yours, the key stays yours, the submission is yours.
We never make the legal calls
Deleted or Exempt is a legal determination. We flag the candidates with their facts; you — or your counsel — decide. We execute and record the decision.
We never sit on raw data
DROP only ever sends hashes. Your records are standardized and hashed at intake, and raw exports are not retained. The work runs under a data processing agreement, hash-first, by design.
Questions of law belong to your lawyer. Questions of whether the cycle ran — on time, completely, provably — belong to us.
Start with your readiness grade.
Two minutes, in your browser: answer seven questions and get your obligation map — which registries, the California cycle, your dated next steps — plus a readiness grade and a working demo of the CalPrivacy hash format on a sample identifier. Nothing you enter is stored or sent anywhere; the check runs entirely on this page.
Questions, answered.
We're not based in California. Does this apply to us?
If the personal information you sell includes California residents, yes — the duty follows the consumer. You register with California in the January window and run the DROP cycle, wherever your business is based. Brokers in the same position also tend to appear on the Texas, Oregon and Vermont registries, which this desk tracks with the same file.
Do you register or file for us?
No — by design. Registration is your legal act, in your own DROP account, under your own login. We prepare the registration answers, configure your lists and key, and run the processing cycles as your service provider under a data processing agreement. Submissions to the state are yours.
Is this legal advice?
No. We are an operations service. Whether you meet the data-broker definition, and whether a matched record is Deleted or Exempt, are legal determinations that stay with you and your counsel. We flag, we execute your decisions, and we keep the evidence that you did.
What do you need from us to start?
A signed data processing agreement, your DROP account with your lists selected and your API key (the portal's manual download works too), and an export of your consumer records. We standardize and hash at intake; raw exports are not retained.
What exactly is in the evidence file?
Per cycle: the lists pulled (with file fingerprints), every request and its disposition, the response files sent, and the timestamps tying them together — a tamper-evident chain that grows every cycle. From January 1, 2028, independent third-party audits examine compliance with these duties; the evidence file is the record those audits will ask for.
January doesn't wait for anyone.
Run the free readiness checker, or tell us where your records live and we'll map your January — registration, first cycle, and the evidence file — in writing.