California's DROP Portal Goes Live August 1. Here's What Data Brokers Actually Have to Do.
63 days out. If you're a data broker operating in California, or you're building software that handles consumer data removal at scale, the California DELETE Act enforcement window isn't theoretical anymore.
Here's what the regulation actually requires — and where most companies are going to fail.
The rule: 45 days, $200/day, no exceptions
Starting August 1, 2026, every registered California data broker must connect to the California Privacy Protection Agency's DROP (Data Removal Opt-out Portal) and process all verified deletion requests within 45 days. The penalty for non-compliance: $200 per request, per day, after the deadline.
That math scales fast. If you're a mid-size data broker sitting on a few thousand pending deletion requests and you miss the deadline by a week, you're looking at seven figures in exposure before anyone files a formal complaint.
The requirements are:
- Access the DROP platform at minimum every 45 days (not once, not quarterly — a rolling 45-day cycle)
- Process every deletion request received — there's no "too many requests" exemption
- Suppress re-acquisition of deleted data — after deletion, you can't re-purchase or re-aggregate that person's data without a new opt-in from the consumer
Where manual processes break
Most data brokers today handle deletion requests through a combination of web forms, email intake, and manual processing queues. That works when you're getting dozens of requests a month. It breaks when you're getting hundreds, or when the California DROP portal starts routing requests from third-party privacy services on behalf of millions of opted-in consumers.
The DROP system is designed to aggregate deletion requests from consumers who've signed up through the state portal. That means a single consumer action on the state's side triggers a deletion request to every registered data broker simultaneously. At scale, that's not a manual process — it's an integration problem.
Three things fail under manual handling:
- Receipt tracking — you need proof that the request was received and timestamped within the 45-day window
- Cross-system propagation — deletion has to happen across every database where that person's data lives, not just the primary record
- Suppression enforcement — you need a flag that prevents re-acquisition, which requires touching your data-ingestion pipeline, not just your records system
The automation requirement
The CPPA's language is clear: deletion mechanisms must be "technically capable" of processing at scale. The agency is explicitly not accepting "we review requests manually" as an answer. The DROP portal is an API, not a web form. It expects automated integrations.
That means brokers need:
- An automated listener on the DROP API endpoint
- A deletion propagation pipeline that hits every data store in scope
- Audit logging of every deletion action (timestamp, record ID, data store, confirmation)
- A suppression list that blocks re-ingestion of deleted records
BizSuite data-removal
BizSuite's data-removal product covers 48 brokers across 5 tiers, with CA SB 362 DROP portal integration built in. The suppression list is maintained automatically — once a record is deleted, re-acquisition is blocked at the ingestion layer. Audit logs are tamper-resistant and exportable for regulatory review.
$497 setup, $49/month. Built for founders and small ops teams that need to stay compliant without a dedicated privacy engineering team.
If you're a data broker that hasn't connected to the DROP API yet, or a developer building privacy compliance tooling for clients, the window to get this set up before August 1 is closing. Book a 15-minute walkthrough at https://cal.com/getbizsuite.
NOTE: DataGrail email in lead has a typo (sales@datagr ail.io). Do not cold-email. This is a content signal article only — publish on BizSuite blog and dev.to. DataGrail is a competitor in this space, not a prospect.
Top comments (0)