California DROP Platform Guide for Data Removal Providers

Quick Answer: The California DROP platform is a free state tool. It sends one deletion request to every registered data broker. It serves verified California residents only, and brokers may keep exempt data such as public records. Removal providers now win on the gaps: other states, unregistered sites, exempt listings, dark web exposure, and proof.

California now runs a free data removal service, and it works. By mid-October 2026, CalPrivacy reported more than 560,000 registered users in its Delete Week update. Brokers had reported close to 100 million consumer profiles deleted. A typical user saw deletions from more than 150 brokers.

For removal providers, that changes the sales conversation with every California customer. A paid plan that only files requests with registered brokers now competes with a free state tool. At renewal, your product has to show what it adds beyond DROP.

This guide covers that shift for consumer privacy apps and security suites that sell or bundle removal. It calls both groups removal providers. It covers how the California DROP platform works and what its statuses mean. It also covers the authorized agent rules and the gaps DROP leaves.

How the California DROP Platform Works Today

The Delete Act (Senate Bill 362) passed in 2023. It required California to build one deletion tool for every registered data broker. That tool is DROP, the Delete Request and Opt-out Platform. It opened to consumers on January 1, 2026.

Brokers began processing requests on August 1, 2026. Since then, each registered broker must download the request list at least every 45 days. Each broker then matches records, deletes them, and reports a status to the state. Our breakdown of Delete Act penalties covers the fines behind that cycle.

Three design choices matter most for removal providers. Each one shapes what a paid plan can add.

One Request That Stays Active

A consumer submits once, and the request keeps working. Brokers that find no match today must check new data against that request later. So a “record not found” status can turn into “deleted” a year later, per the DROP FAQ.

Hashed Identifiers, Not Raw Data

DROP stores scrambled codes, called hashes, instead of raw personal data. Brokers scramble their own records the same way and compare the two. Consumers can add a name, birth date, ZIP code, email, and phone number. Optional fields cover mobile advertising, connected TV, and vehicle IDs. More identifiers raise the chance of a match.

Status Updates Take Time

Status updates can take up to 90 days to appear. Consumers check progress with a private DROP ID. CalPrivacy tells consumers never to share that ID with anyone.

What the Five DROP Statuses Mean for Removal Providers

Every broker on the California DROP platform reports one of five statuses for each request. CalPrivacy defines them in its own status guide. Each status tells a removal provider something different about the work that remains.

DROP Status	What the Broker Did	What Can Stay Exposed	What a Removal Provider Adds
Record deleted	Matched the request and deleted non-exempt data	Exempt data and listings on unregistered sites	Evidence that the public listing came down
Record exempted	Matched the request but kept data the law allows	Public record listings and first-party data	Direct opt-outs on sites that run their own process
Record opted out of sale	Found several people tied to the identifiers, so it stopped sale only	The record itself	Extra identifiers and follow-up checks
Record not found	Found no match in its current records	Listings tied to identifiers the user never entered	Discovery scans across sites outside the registry
Pending	Has not processed the request yet	Everything, for up to 90 days	Interim monitoring and clear status reporting

The exempted status deserves the most attention. CalPrivacy names public records and data a consumer gave directly as common exempt examples. Many people-search listings draw on property, court, and voter records. So a consumer can see “exempted” in DROP and still find a live listing about themselves.

Where the California DROP Platform Stops

DROP covers a lot of ground, but the law fixes its edges. Four gaps remain, and each one maps to a paid service.

People Outside California

DROP serves verified California residents only. The state checks residency through the California Identity Gateway or Login.gov before any request goes out. Every customer in the other 49 states still needs another route.

Brokers Not on the Registry

DROP reaches registered brokers only, and that list passed 660 companies in October 2026. A company that never registers never downloads the request list. CalPrivacy fined three companies in August and September 2026 for failing to register or registering late. Each of those firms sat outside DROP until regulators caught up.

Public Records and Other Exempt Data

The Delete Act uses the state privacy law’s meaning of personal information. That meaning leaves out public data, such as government records. Data a consumer handed to a business directly also stays outside DROP. Credit, financial, and health data follow their own federal carve-outs instead.

Exposure That Never Touches a Broker

Some of the worst exposure never passes through a broker at all. Stolen passwords, login cookies, and malware logs trade on dark web markets instead. DROP has no reach there, because no registered company holds that data. Our guide to exposure intelligence shows why broker listings and breach data need one linked view.

Authorized Agent Rules: What Removal Providers Can Do Inside DROP

The Delete Act lets an authorized agent help a consumer on the California DROP platform. The DROP regulations set strict terms for that help. A removal provider that wants to act as an agent must design around four rules:

• Residency comes first. The state must verify the consumer’s California residency before an agent can help.
• The agent gets named. The consumer or agent must disclose the agent’s full name, email, and trade name in the consumer’s DROP account.
• Brokers do not call back. Brokers may not contact consumers to verify a DROP request.
• The DROP ID stays private. CalPrivacy tells consumers never to share the ID that opens their request.

In practice, these rules favor a guided flow over a hidden one. A provider can walk a California user through sign-up inside its own app. The rules leave no room for bulk filing for users the state never checked. Every product promise needs to match that.

How DROP Changes the Removal Provider Value Proposition

Before DROP, request volume was the product. A provider sold the hours it saved on hundreds of broker forms. For California customers, the California DROP platform now does much of that work for free.

Consider an illustrative removal provider with 50,000 subscribers, 6,000 of them in California. These are round numbers, not data from any partner. Suppose the plan pitch centers on registered-broker requests. Those 6,000 customers can now get much of that pitch for free. Even a 10% renewal loss in that group means 600 cancelled plans each year.

The fix is a pitch built on what DROP leaves undone. Three shifts make that real.

From Request Volume to Evidence

DROP shows a status code, not a screenshot of a removed listing. A provider that saves listing details before and after removal gives users proof. That proof also answers support tickets and backs up renewal emails. The full removal workflow shows where evidence fits in each step.

From California Coverage to National Coverage

A national product treats DROP as one input, not the whole service. California users get a guided DROP step plus direct opt-outs for unregistered and exempt listings. Users in every other state get the full removal service from day one.

From One-Time Cleanup to Continuous Monitoring

Brokers rebuild listings from new public records and resold data. That re-listing cycle is why removal works as recurring revenue for a subscription product. Adding dark web monitoring extends the same plan to stolen credentials that brokers never touch.

What Changes Next for the California DROP Platform

DROP keeps getting stricter, and each change shrinks the easy part of removal further. A Freshfields summary of the August 2026 CalPrivacy Board meeting lists three updates already on the record:

• Wider suppression screening. Proposed amendments would make brokers screen new data against every past DROP request, including no-match requests.
• Higher broker fees. Registration and access fees rise to $9,500 for the 2027 period, an increase of $3,500.
• Independent audits. From January 1, 2028, audits every three years must verify nine components, from hashing to suppression lists.

Each change makes brokers on the list more careful inside California. That is good news for consumers. For removal providers, registered-broker filing in California will matter less as a selling point every year. The state also launched an annual Delete Week in October 2026 to promote its free tool. Your California users will hear about DROP every autumn, whether your product mentions it or not.

A DROP-Aware Product Checklist for Removal Providers

A DROP-aware product treats the state tool as a partner, not a rival. The checklist below turns the gaps above into product requirements:

• Detect residency early, and route California users to a guided DROP step.
• Never ask users for their DROP ID, and show your own evidence instead.
• Scan people-search sites outside the registry for every user in every state.
• File direct opt-outs on sites that report “exempted” but still run their own process.
• Re-check listings monthly, since brokers re-list data from fresh public records.
• Add dark web monitoring for exposure that never touches a broker.
• Write marketing copy that calls DROP free and explains what your plan adds.

Vendor choice decides how many of these items ship on day one. Our checklist for evaluating removal vendors covers coverage, API depth, and registry integration.

How PureVPN White Label Digital Privacy Protection Fits

PureVPN White Label Digital Privacy Protection runs data broker opt-out and dark web monitoring on one engine. The opt-out side scans 400+ people-search and broker sites across the US, the EU, and other regions. It files requests where each site allows, tracks them to status, and re-checks monthly. Every finding keeps listing details and screenshots, so partners show proof instead of a status code.

Partners launch it as a hosted platform, an API and SDK, or a mix of both. The platform holds SOC 2 Type II and ISO 27001 certification, with audit reports shared under NDA. The 400+ site and 150+ partner figures are PureVPN’s own reported data, not third-party audited. The platform page shows each deployment path.

Conclusion: Build Around the California DROP Platform, Not Against It

The California DROP platform now handles the bulk filing that once defined paid removal for Californians. It still stops at state lines, the registry, exempt public records, and the dark web. Removal providers that build around those edges keep a clear reason to renew. Providers that resell the free part will feel that pressure every October.

Request API sandbox access for a 20-minute integration walkthrough.