California DROP: Delete Request and Opt-Out Platform

DROP stands for "Delete Request and Opt-Out Platform." It is the California Privacy Protection Agency’s (CPPA) mechanism created under the Delete Act (SB 362). A California resident can submit a single verifiable request directed to active data brokers covered by the mechanism, subject to non-exempt data, matching, verification, and other limits.

The CPPA says data brokers must begin processing DROP requests on August 1, 2026, access DROP at least once every 45 days, and report request status within the required timeline. Check the live CPPA consumer and broker pages for current access, status, and exceptions.

A California resident submits one verifiable request through the current DROP process. The request is directed to active data brokers covered by California law, and each broker must access DROP at least once every 45 days and process requests within the required timeline. A provider-specific follow-up may still be needed for scope, matching, exceptions, or other sources.

The current CPPA guidance describes registration, applicable fees, DROP account and processing duties, at-least-45-day access, limited exceptions, and later audit requirements. Confirm the filing year, entity status, fee, and exact obligation in the live CPPA instructions before relying on a checklist.

SB 361 (2025) expanded California data-broker disclosure requirements. The CPPA describes additional sensitive-data, personal-information, and sharing-practice fields; use the current filing and CPPA guidance to distinguish a required disclosure from a claim that a broker actually holds or sells a particular field.

DROP is the California mechanism, and the current CPPA process determines eligibility and verification. Residents elsewhere must use the rights and routes that apply in their own jurisdiction; do not assume a provider will extend California treatment or that a DROP request controls a non-covered source.

No, it supplements them. CCPA’s right to delete against any covered business still exists. DROP specifically handles deletions from registered data brokers. Consumers may continue to submit direct CCPA deletion requests to any broker, or use DROP for batch processing. For businesses that aren’t data brokers (e.g., a retailer), direct CCPA requests remain the path.

You must verify California residency before submitting a request, then choose the identifying information the current process accepts for matching. The current DROP Terms say that submitting a request consents to disclosure of the personal information you provide to data brokers for processing. The consumer guidance describes encrypted and hashed matching, so review the live Terms and provide only accurate information you are comfortable submitting.

The Delete Act and CPPA guidance provide administrative enforcement and penalty provisions, but the applicable provision, amount, day count, entity status, and facts matter. Preserve the request and status evidence, then use the current CPPA complaint or enforcement information before asserting a violation.

DROP changes the available California route, but provider-managed services may still differ in authorization, monitoring, source scope, reporting, and follow-up. Compare current terms; do not assume the state mechanism makes every paid workflow redundant or guarantees a particular outcome.

It can remain useful for a different workflow: OfflistMe prepares user-reviewed drafts and route links for selected catalog profiles, while you send, verify, and follow up. It is separate from DROP, does not submit to the state platform, and does not guarantee coverage or an outcome.