If you operate a data brokerage registered with the California Privacy Protection Agency (CPPA), the DROP Act compliance deadline passed on August 1, 2026. If you are reading this after that date, you are already accruing penalties. Here is what the law requires, what it costs to ignore, and how to fix it without a six-figure enterprise contract.
The short version
The California Delete Act (SB 362) created the DROP (Delete Request and Opt-Out Platform) - a state-run system where consumers submit a single deletion request that propagates to every registered data broker. As of August 1, 2026, every registered broker must:
- Pull the hashed identifier list from the DROP platform every 45 days
- Match those identifiers against their own customer records
- Delete matched records from every system they operate
- Report back to the DROP platform with audit data
Penalties start at $200 per unprocessed request, per day. There is no cure period. The CPPA enforcement strike force is actively fining non-compliant brokers.
Who is in scope
As of July 2026, the CPPA listed 575+ registered data brokers. If you are on that list, the DROP Act applies to you. There is no revenue exemption, no employee-count exemption, and no grace period. Even unverifiable consumer requests must be processed as opt-outs of sale or sharing - creating a suppression list obligation that lasts indefinitely.
The number of registered brokers has grown about 15% year over year, and consumer registrations on the DROP platform are projected to hit millions by the end of 2026.
The four things the DROP Act requires
1. 45-day cycle pulls. Every 45 days, your brokerage must download the latest batch of hashed consumer identifiers from the DROP API. Consumers who registered during that window need to be identified in your systems. Miss a pull and every request in that window becomes a violation.
2. Identifier hashing and matching. The DROP platform provides hashed identifiers - phone numbers, email addresses, names, dates of birth. Your brokerage needs to standardize its own data formats (strip formatting, normalize casing) and hash them using the same algorithm before matching. Format mismatches are the most common source of false negatives.
3. Multi-system deletion cascade. A single deletion request must propagate through every system your brokerage uses: data warehouses, analytics platforms, vendor databases, ad-tech pipelines, sub-processor systems, and backup archives. Deleting from one database but not another leaves you exposed.
4. Audit logging and reporting. Each request must produce timestamped documentation: when it was received, how identity was verified, which systems were acted on, what disposition was taken, and proof of recurring compliance. Without solid audit trails, an enforcement action is nearly impossible to defend.
What this costs if you ignore it
Real numbers. If 50 consumers submitted deletion requests for your brokerage during the first 45-day window and you did not process them:
- 50 requests x $200/day = $10,000/day in penalties
- Over 30 days: $300,000
- Over one 45-day cycle: $450,000
The CPPA already fined Datamasters $42,000 in January 2026. Fenwick, a law firm tracking DROP enforcement, calculated a hypothetical $10 million per day exposure for a broker that ignored 50,000 unprocessed requests. The penalty math scales fast.
Beyond fines, there is business risk. Enterprise customers increasingly require proof of data broker compliance in procurement reviews. A non-compliant brokerage loses deals, not just cash.
What this costs to fix
You do not need DataGrail at $10,000 per year or Captain Compliance at $449 per month for a small brokerage. The actual operational needs are:
- A cron job that pulls the DROP API list every 45 days
- A hashing utility that matches your customer data against the DROP list
- A spreadsheet tracker (or better, an audit log) of which systems each deletion was applied to
- A one-page report template for audit purposes
Doing this manually takes a few hours per 45-day cycle once the pipeline is set up. Most of the complexity comes from the identifier matching step, which is where a tool actually saves you time and reduces error rates.
Captain Compliance vs. Compliance Copilot
Captain Compliance announced their DROP Act Automation module in May 2026 with a press cycle that included Yahoo Finance. Their pricing starts at $449 per month, and the product is aimed at agencies and larger brokers managing multiple clients.
Compliance Copilot is built for the other end of the market: the solo data broker or small team that needs DROP compliance without the enterprise features (consent management, cookie scanning, GDPR DSAR) they will never use. Our DROP module starts at $29 per month and covers exactly the 45-day cycle, identifier matching, and audit reporting that the DROP Act requires.
Neither product replaces legal counsel. Both are faster than building your own DROP API integration from scratch.
A simple way to check where you stand
Three questions:
- Have you pulled the DROP identifier list since August 1, 2026?
- Have you matched those identifiers against your customer database?
- Do you have a timestamped audit trail of what was deleted, when, and from which systems?
If you answered no to any of these, you have a compliance gap. How wide that gap is depends on how many consumer requests have gone unprocessed.
The bottom line
The DROP Act deadline passed. The penalties are real and they start from day one. But the actual technical work is not complex - it is a recurring 45-day data pipeline with hash matching and audit logging. The hard part is setting it up and remembering to run it every cycle.
If you already know your data systems and you are organized, you can do this yourself in an afternoon with the DROP sandbox API and a few scripts. If you would rather have a tool handle the 45-day schedule, identifier matching, and audit reports for you, that is what we built.
Check your DROP compliance status at securemymvp.com/drop-act ->
This article is informational, not legal advice. Consult qualified counsel for compliance decisions specific to your business.