This guide is for California-registered data brokers organizing their own vendor outreach. It is not legal advice. Confirm current duties with counsel and with CalPrivacy’s published materials.
What “vendor notification” means here
When a broker finds a match against a DROP consumer deletion list, CalPrivacy’s processing guidance says the broker must delete non-exempt personal information and direct service providers and contractors to delete matching records (or, in multi-consumer identifier cases, to opt out of sale or sharing accordingly).
Source: Processing DROP requests (privacy.ca.gov).
This page is about the desk work around that direction: who you ask, what you send, and what you keep. Drop Ledger can help you organize those asks and answers. It does not access DROP, delete data, or decide whether a request is valid.
Before you send anything
- Confirm the cycle window you are working. Today’s published recurring access cadence is at least every 45 days, with 30 days effective January 1, 2027 under AB 883. See the companion guide. Sources: DROP for data brokers, Processing DROP requests.
- List every service provider or contractor that stores, processes, or derives a copy of the personal information in scope for this batch.
- Confirm the email or portal you will actually use for each vendor.
- Name the batch with a stable id so later answers can be filed against the same window.
A simple notification packet
Keep each vendor packet consistent:
- Your company name and a reply contact.
- The cycle name and due date you are using for desk tracking. That date is a planning estimate, not a legal determination.
- What you need back: acknowledgment that they received the instruction, or an exception with a short reason. Your counsel should define acceptable reasons.
- A pointer to the identifiers or file channel you already agreed contractually. Do not paste raw consumer data into a casual email body if your process uses a secure link or portal.
- A clear ask for a timestamped reply.
Drop Ledger’s model is a private acknowledgment link per vendor for a cycle. Treat that link as a credential. Do not forward it broadly.
While the window is open
- Track sent, answered, and outstanding in one place.
- Send reminders on a fixed cadence you choose for operations. Many desks use roughly day 7 and day 14. That is an operations habit, not a statute quoted here.
- When an answer arrives, cancel open reminders for that vendor.
- If mail fails, copy the link or packet from your cycle record and send another way.
What to file when you close the window
For each vendor: sent time, reminder times, acknowledgment or exception, and any note. Export a CSV for search and a PDF for handoff. An evidence file is a record of what you asked and what came back, not a finding that another company deleted a row in its database.
Where Drop Ledger fits
Drop Ledger helps a small broker organize vendors, acknowledgment links, reminders, and an export for each window. Founding prices start at $149/month. Try the demo with no signup, or see pricing.
It is not legal advice and does not connect to DROP.
Sources
- CalPrivacy — DROP for data brokers
- CalPrivacy — Processing DROP requests
- CPPA — Accessible Deletion Mechanism / DROP system requirements