What does DROP stand for?

DROP is California's Delete Request and Opt-out Platform, operated for Delete Act (SB 362) deletion requests to registered data brokers. See privacy.ca.gov/drop/.

When could consumers start submitting DROP requests?

According to CalPrivacy materials, California residents have been able to submit DROP deletion requests since January 1, 2026.

When must data brokers process DROP requests?

Starting August 1, 2026, registered data brokers must process DROP deletion requests at least once every 45 days and report each request's status per CalPrivacy processing guidance.

What penalty does CalPrivacy describe for unprocessed deletion requests?

CalPrivacy broker materials describe $200 per day per deletion request when a broker fails to delete as required under the Delete Act, plus investigation and administrative costs. Confirm current official text for enforcement details.

Does DROP replace FCRA compliance?

No. DROP is a California data-broker deletion framework. FCRA governs consumer reports used for covered purposes. Buyers should map each feed to the correct regime.

Where does GSDSI publish broker registration and DROP posture?

On /trust/data-broker-registrations and in the privacy policy, with the authoritative California listing on the CPPA Data Broker Registry.

How should an organization test its readiness for deletion requests?

By tracing one identifier through every system holding licensed data, including derived tables, warehouse copies, and downstream platforms, and timing complete removal. Most find a copy that was not on the list, which is the point of running it in advance.

California Delete Act DROP: Buyer Guide

This page is informational for enterprise data buyers. It is not legal advice. Primary sources: CalPrivacy DROP, DROP for data brokers, Processing DROP requests, and SB 362 / Delete Act (Cal. Civ. Code §1798.99.80 et seq.). Pair with data broker registrations, privacy policy, and FCRA vs non-FCRA.

What is California Delete Act DROP?

What data buyers should ask their vendors about DROP

Diligence question	Why it matters	Evidence to request	Primary source
Are you a California-registered data broker?	DROP duties attach to registered brokers	CPPA registry listing + registration date	privacy.ca.gov DROP broker pages
When do you start the 45-day DROP cycle?	Operational duty begins August 1, 2026	Written ops plan + calendar owner	CalPrivacy process-DROP guidance
How do you report status per request?	Status reporting is part of the cycle	Sample status workflow or API path	CalPrivacy process-DROP guidance
Do you keep a stay-deleted suppression ledger?	Future refreshes must not reintroduce deleted consumers	Suppression design + retention of delete keys	Delete Act + contract exhibit
How do deletes propagate to service providers?	Downstream copies can recreate exposure	Vendor list + delete propagation SLA	Contract + sub-processor map
Which SKUs are FCRA vs marketing-only?	FCRA is a different legal regime	Product classification matrix	FCRA vs non-FCRA buyer guide

Timeline Buyers Should Calendar

Per CalPrivacy DROP and DROP for data brokers: California residents have been able to submit deletion requests through DROP since January 1, 2026. Starting August 1, 2026, data brokers must begin processing those requests. Brokers must access DROP and process deletion requests at least once every 45 days, including downloading request lists and reporting status for each request within the required cycle. Confirm current official text before relying on this framing in a contract.

Penalties Called Out by CalPrivacy

CalPrivacy's broker materials describe monetary exposure for noncompliance, including $200 per day per deletion request when a broker fails to delete information as required under the Delete Act, plus CalPrivacy's investigation and administrative costs. Separate $200 per day framing also appears for registration failures. Buyers should not treat a sales deck "compliant" claim as proof of DROP operations. Ask for the ops calendar, status-reporting method, and last successful cycle evidence after August 1, 2026.

Suppression Ledgers and Service-Provider Propagation

Deletion is not a one-time file scrub. Brokers need a suppression ledger so future refreshes and new collections do not reintroduce a consumer who already requested deletion. CalPrivacy processing guidance also describes status changes over time (for example, a later match after an earlier "not found"). Buyers licensing identity, email, mobility, or intent feeds should require: (1) stay-deleted controls on refresh, (2) delete propagation to service providers and contractors, and (3) contract language that matches those workflows. See GSDSI sub-processors and privacy center for how rights requests are routed on this site.

DROP Is Not the FCRA Regime

The Delete Act / DROP framework targets data broker deletion and related opt-out mechanics under California Civil Code §1798.99.80 et seq. The Fair Credit Reporting Act governs consumer reports used for covered purposes (credit, employment, and related decisioning). Do not collapse the two. Marketing-only licenses can still carry DROP and state privacy duties. Covered FCRA uses need permissible-purpose and CRA workflows. Start with FCRA vs non-FCRA lead data when a vendor blurs those lanes.

GSDSI Posture (Factual)

GSDSI is a registered California data broker. Registration status and multi-state filings are published at data broker registrations, with the authoritative California listing on the CPPA Data Broker Registry. Our privacy policy states that from August 1, 2026, GSDSI will process eligible DROP deletion requests at least every 45 days. Consumers may also use on-site rights paths via Do Not Sell and privacy center. We do not claim DROP "completion" ahead of the August 1 operational start. Ask counsel to verify current registry and ops status during diligence. For the registration deadline, fee and penalty in each state with an enacted data broker law, with a link to each statute, see the state data broker registration tracker.

Readiness Is an Operational Question, Not Only a Legal One

Most of the work a deletion-request regime creates is operational rather than interpretive. The obligations are comparatively clear; what decides whether an organization can meet them is whether it knows where its data actually is, whether removals reach every copy, and how long that takes end to end. Those are engineering facts, and they are usually unknown until somebody measures them.

Test the mechanism rather than describing it. Trace a single identifier through every system holding licensed data, including derived tables, warehouse copies, and anything pushed to a downstream platform, and time how long complete removal takes. Most organizations find at least one copy that was not on the list, which is exactly why the exercise is worth running before it is needed. Record the result with a date, so the next review begins from a measurement rather than a memory. This is operational guidance and not legal advice; confirm the requirements applying to your organization with counsel.

Next Steps for Buyers and Media

Procurement: attach the checklist table above to your vendor questionnaire and require exhibits before annual renewals. Media and analysts: start from Company and editorial standards for boilerplate context, or email info@gsdsi.com. Product-scope questions: contact or privacy@gsdsi.com. Related reading: state broker registration diligence and data brokers post-FTC orders.

Frequently Asked Questions

What does DROP stand for?: DROP is California's Delete Request and Opt-out Platform, operated for Delete Act (SB 362) deletion requests to registered data brokers. See privacy.ca.gov/drop/.
When could consumers start submitting DROP requests?: According to CalPrivacy materials, California residents have been able to submit DROP deletion requests since January 1, 2026.
When must data brokers process DROP requests?: Starting August 1, 2026, registered data brokers must process DROP deletion requests at least once every 45 days and report each request's status per CalPrivacy processing guidance.
What penalty does CalPrivacy describe for unprocessed deletion requests?: CalPrivacy broker materials describe $200 per day per deletion request when a broker fails to delete as required under the Delete Act, plus investigation and administrative costs. Confirm current official text for enforcement details.
Does DROP replace FCRA compliance?: No. DROP is a California data-broker deletion framework. FCRA governs consumer reports used for covered purposes. Buyers should map each feed to the correct regime.
Where does GSDSI publish broker registration and DROP posture?: On /trust/data-broker-registrations and in the privacy policy, with the authoritative California listing on the CPPA Data Broker Registry.
How should an organization test its readiness for deletion requests?: By tracing one identifier through every system holding licensed data, including derived tables, warehouse copies, and downstream platforms, and timing complete removal. Most find a copy that was not on the list, which is the point of running it in advance.