By ByteBot
August 1 has passed, and California’s Deletion Request and Opt-Out Platform is no longer a policy deadline on a slide deck — it’s an active enforcement mechanism. Over 260,000 consumer deletion requests that queued since January now carry a $200-per-request, per-day fine for data brokers who fail to process them. At current request volumes, missing a single 45-day retrieval cycle isn’t a compliance slip; it’s a nine-figure exposure.
What DROP Actually Is
DROP — the Delete Request and Opt-Out Platform — is a government-run portal operated by the California Privacy Protection Agency (CalPrivacy). California residents submit a single deletion request to the platform, and that request flows simultaneously to every registered data broker. No more contacting 600 companies individually. For consumers, it’s a one-stop shop. For data brokers, it’s a centralized deadline machine.
The mechanics: brokers must retrieve new deletion request batches at least every 45 days, match records across all their systems, process deletions, and report outcomes back to CalPrivacy within 90 days. The four outcome codes are straightforward — deleted, opted-out, exempt, or not found. The fine for ignoring the cycle is not.
You Might Already Be a Data Broker
Here’s where developers building SaaS products need to slow down and read the definition: California classifies as a data broker “any business that knowingly collects and sells the personal information of a consumer with whom the business does not have a direct relationship.” The word “sells” includes sharing data “for monetary or other valuable consideration” — a phrase broad enough to sweep in advertising attribution, enrichment APIs, and audience segment licensing.
Categories that routinely catch companies off guard: data enrichment services that append or validate customer records using third-party sources, lead generation platforms building targeted audiences from purchased data, analytics vendors providing insights or attribution across non-customer populations, and retailers selling behavioral audience segments to brand partners. CalPrivacy has been explicit: companies should not assume they’re exempt. The agency already collected $62,000 from S&P Global and $42,000 from Rickenbacher Data LLC — both fined before August 1 enforcement even started, simply for failing to register.
Delete the Inferences, Not Just the Row
The part most engineering teams miss: the California DELETE Act requires deletion of raw PII and any inferences derived from it. Every algorithmic profile — “financially vulnerable,” “likely pregnant,” “politically conservative,” “probable health condition” — must be erased along with the underlying record. Deleting the database row and keeping the model output is not compliant. And you cannot re-collect or re-sell the data later; data brokers must maintain suppression lists that block opted-out identifiers from future pipelines.
The Engineering Checklist for DROP Compliance
If your company qualifies as a data broker, here is what needs to be built for California DROP compliance:
- Register at privacy.ca.gov/data-brokers — $6,000 annual fee, required before accessing the DROP platform
- Integrate the CalPrivacy API — the sandbox has been open since April 7, 2026; the technical API reference is public; manual 45-day downloads are an option but operationally painful at scale
- Map your identifiers — understand which emails, phone numbers, and MAIDs you hold and normalize formatting before matching against DROP records
- Query everything — databases, data warehouses, CRMs, SaaS tools; the obligation extends to every system where the consumer’s data lives
- Delete the inferences — not just the raw record; any derived conclusion about the person must be erased from all systems
- Build suppression infrastructure — block opted-out identifiers from future data sales, transfers, or pipeline ingestion
- Report back to CalPrivacy — submit outcome codes (deleted / opted-out / exempt / not found) within 90 days of retrieving the request batch
- Audit log everything — timestamps, identifiers used, systems queried, determinations made; mandatory third-party audits begin January 1, 2028
For a detailed engineering walkthrough, Transcend’s DROP compliance guide maps the full integration end-to-end.
The Stakes Are Real
The fine math is clarifying: 260,000 queued requests multiplied by $200 per day per request. One missed retrieval cycle produces astronomical theoretical liability. Even at a fraction of that — 50,000 unprocessed requests — non-compliance costs over $10 million per day. CalPrivacy didn’t build this enforcement mechanism and hire a Chief Privacy Auditor to let fines go uncollected.
DROP is also without precedent at this scale. No other US state or country runs a centralized government-operated deletion platform serving hundreds of millions of people. Vermont and Texas are watching. The California Delete Act (SB 362) may be the template for what privacy enforcement looks like nationally. If you are building anything that touches personal data at scale, understanding DROP now is not optional — it’s the preview of what’s coming everywhere.
