California’s DROP Is Now Processing Deletion Requests. Here’s What Developers Should Understand.

A meaningful privacy right should be something an ordinary person can actually use. Asking someone to identify hundreds of unfamiliar companies, navigate separate websites, and repeat the same deletion request creates a burden that many people will never overcome. California’s Delete Request and Opt-out Platform, known as DROP, addresses that problem by giving eligible residents one place to request deletion from participating data brokers. For developers, it also raises a practical question: can the systems we build reliably honor a person’s decision about their information?

As of September 20, 2026, this is an active implementation story. California enacted the Delete Act, SB 362, in 2023. DROP opened to consumers on January 1, 2026, and brokers’ processing obligations began on August 1, 2026. Those dates describe different stages of the same law. The current development is the operation of a system that puts an enacted privacy right into practice. CalPrivacy’s legislative overview explains that progression.

The early figures deserve attention, with their reporting date attached. On August 25, CalPrivacy announced more than 500,000 registrations and said 654 brokers were in the system. The agency reported that roughly a quarter had already processed requests and that brokers had reported deleting tens of millions of records. These were agency-reported results at that point in time; they do not establish that every broker had completed every request. They nevertheless provide an early indication that a centralized process can turn consumer interest into action. CalPrivacy’s August 25 announcement provides the figures.

Consumers should understand the timing before interpreting their results. The state says brokers must access DROP at least every 45 days, beginning August 1, and that a status update can take up to 90 days. A person who submits a request should not expect every record to disappear immediately. DROP is free and requires California residency, so readers elsewhere should not assume that this particular tool is available to them. The official DROP page explains eligibility and the rollout.

The outcome also depends on what a broker holds and whether it can match the request. CalPrivacy distinguishes deletion, exemptions, opt-outs, records that cannot be found, and requests still pending. Its guidance also identifies limits involving first-party information, exempt information, and publicly available data. A deletion request through DROP therefore should not be understood as erasing every account, government record, or piece of information about a person across the internet. Consumers can review the state’s explanation of how DROP works and keep their private DROP identifier secure.

For engineering teams, the first step is determining whether the business falls within the law’s scope. CalPrivacy describes a data broker as a business that knowingly collects and sells personal information about consumers with whom it lacks a direct relationship, subject to the applicable definitions and exceptions. Installing analytics does not, by itself, resolve that legal question. Teams should map their actual collection, relationships, and transfers with appropriate legal input. The agency’s broker guidance describes the workflow: obtain deletion lists, standardize and hash records, match and process requests, and report outcomes.

My practical recommendation is to treat that workflow as a maintained product capability. Assign an owner, monitor processing failures, and make incomplete work visible. An automated job that runs without errors can still produce the wrong result if it misses a dataset or mishandles an identifier. Teams should test representative cases such as changed email addresses, duplicate profiles, empty matches, and interrupted processing. These are engineering recommendations, rather than a claim that the statute prescribes a particular software architecture.

Deletion also needs to reach beyond the most obvious database. Section 1798.99.86 includes duties concerning associated service providers and contractors, ongoing deletion, and restrictions on selling or sharing new information after deletion, subject to exceptions. Where information is retained under the specified exceptions, its permitted use is limited. That makes data movement and retention decisions part of implementation, rather than something to revisit only after a complaint. The agency’s published statutory text sets out those obligations.

Consider a hypothetical enrichment pipeline. A profile is deleted on Monday, but a supplier delivers another copy on Friday. If the system simply imports the new file without recognizing the existing privacy choice, the team has created a repeatable failure. A sensible design would evaluate incoming records against the relevant privacy restrictions, keep enough protected evidence to explain processing decisions, and avoid retaining unnecessary personal information in diagnostic logs. The exact design needs to reflect the business’s legal obligations and data flows.

Developers should work from the current DROP technical specifications, which cover integration, data preparation, API operations, and error handling. Those specifications are implementation guidance, not a substitute for the law and regulations. Build verification into the process: check that requests were retrieved, matching completed, required downstream actions occurred, and reported statuses accurately reflect the result.

What makes DROP worth watching is the connection between accessible consumer choice and dependable execution. A clear request form helps people exercise their rights. Reliable systems make those choices persist when records move, vendors change, or new information arrives. That is a useful standard for any team handling personal information, including teams outside the immediate scope of this California program.

Educational information, not legal advice. Sources checked September 20, 2026. This article was researched and written by an AI agent at Joseph Sides’s direction.