EraseCycle

How ready is your DROP process?

Ten questions, taken from CalPrivacy’s published rules and the DROP API spec. Every “No” or “Not sure” is a gap that can turn into unprocessed requests. At the end you get a score and a specific fix for each gap.

Your answers stay in this browser. Scoring happens on the page. Nothing is stored or sent, and closing the tab clears it.

The email button at the end only opens a draft in your own mail app. You can edit it, or not send it.

Are you registered for 2027, with the fee paid by 31 January 2027, and is your DROP account in your company’s own name?

Unregistered brokers have been the main enforcement target so far. Announced settlements range from $34,400 to $110,490.

Are you downloading DROP lists at least every 45 days now, and ready for every 30 days from 1 January 2027?

The cycle shortens on 1 January 2027, under AB 883.

Have you selected every list type that matches data you hold? That’s Email, Phone, MAID, NDZ (name, date of birth and ZIP), NameVIN and CTVID.

Skip a list you hold data for, and those requests go unprocessed.

Do you standardize records exactly to the spec before hashing? Email with all whitespace removed and lowercased, phone as the last 10 digits, ZIP as the first 5, names folded to plain letters and digits.

One formatting slip means silent non-matches. The request looks processed and the data is never deleted.

Do you hash with SHA-256, encoded as Base64, including the composite rule for NDZ and NameVIN (hash each field, join, hash again)?

Hex instead of Base64, or a missed composite step, makes matching fail quietly.

Do you check every system that holds consumer data (warehouse, CRM, files, ad platforms, partner feeds), and delete inferences too?

Deletion covers all non-exempt personal information, inferences included.

When one identifier links to several people, do you opt all of them out of sale and sharing instead of deleting?

The rules require a different action when one identifier matches more than one consumer.

Do you tell your service providers and contractors to delete or opt out, and keep proof that you did?

It’s a required step, and an auditor will ask for the proof.

Do you report a status for every request within 45 days (Exempted, Deleted, Opted out, Not found), and correct mistakes through the amend endpoint?

A missing status looks like an unprocessed request. Law-firm summaries put that at $200 per request, per day.

Do you keep a suppression list, screen new data against it before every sale or share, and log each cycle for the independent audits that start on 1 January 2028?

Deleted people can come back in through new data, and the audit will want evidence.

If your automated connection to DROP fails, do you know you must tell CalPrivacy in writing within 45 days?

Not scored. It’s just a rule that catches people out.

About your setup (optional)

Only used if you choose to email me your results, so I can come prepared.

Where does your consumer data live?
Who handles DROP today?