Confirm every date and duty against CalPrivacy and the statute. This page is a planning aid, not legal advice.
What DROP is
DROP — the Delete Request and Opt-out Platform — is California’s accessible deletion mechanism for registered data brokers under the Delete Act. Consumers submit requests through the state. Brokers download hashed consumer deletion lists, match and process them in their own systems, direct service providers and contractors as required, and report status back in DROP.
Sources: DROP for data brokers, Processing DROP requests, CPPA DROP regulations page.
Today’s published cadence: 45 days
CalPrivacy’s broker materials state that starting August 1, 2026, data brokers must begin processing DROP requests at least once every 45 days. The processing overview repeats: download lists, standardize and hash, match and process, report status, and repeat at least once every 45 days.
The same process page explains that the cycle starts when you download a list. You must download the next list within 45 days of your last download date, and report status within 45 days of downloading the request.
Source: Processing DROP requests.
What changes on January 1, 2027
CalPrivacy’s DROP-for-brokers page states that with the passage of AB 883, data brokers will be required to process deletion requests at least once every 30 days effective January 1, 2027, with more information to follow from the agency.
Source: DROP for data brokers.
Secondary commentary from law-firm blogs describes AB 883 as shortening both access and processing intervals from 45 to 30 days. Prefer the agency page and the chaptered bill text when you update desk procedures.
Why the shorter window stresses vendor follow-up
A shorter recurring cycle leaves less calendar room for matching and internal deletion work, directing service providers and contractors, collecting acknowledgments or exceptions, and reporting status in DROP.
Desks that already chase vendors in a spreadsheet will feel the squeeze first. The duty language about directing service providers remains on the processing page regardless of whether your internal tracker is 45 or 30 days.
A practical planning checklist
These steps are operations, not law.
- Put two calendars on the wall: the current 45-day rhythm, and a 30-day rhythm labeled “from 1 Jan 2027 — confirm with CalPrivacy.”
- Measure how many days your slowest vendor usually takes to answer.
- Decide what “done enough to report status” means with counsel. This guide will not define it.
- Keep one evidence file per window: batch, vendors asked, answers, reminders, close time, and export checksum.
- Re-read CalPrivacy’s process page when the agency publishes AB 883 implementation details.
Scale context, cited and dated
CalPrivacy reported on August 25, 2026 that more than 500,000 Californians had registered for DROP and that 654 data brokers were part of the system.
Source: Half a Million Californians Have Signed up for DROP.
CPPA board materials circulated for an August 2026 meeting cited 345,000+ requests and 600+ brokers required to access DROP as of July 15, 2026 (meeting PDF). Numbers move. Cite the date when you quote them.
Where Drop Ledger fits
Drop Ledger is a workspace for naming a cycle window, asking vendors, tracking acknowledgments, and exporting an evidence file. It does not access DROP and is not legal advice. Pricing · Demo
Sources
- DROP for data brokers — 45-day start; AB 883 to 30 days from January 1, 2027
- Processing DROP requests
- CPPA DROP regulations
- CalPrivacy August 25, 2026 press release
- CPPA DROP update PDF