California Delete Act Data Broker Deletion Workflow

Decide scope for each legal entity. Under section 7601(d), a direct relationship requires the consumer to intentionally interact with the business to access, purchase, use, request, or obtain information about its products or services. A rights request or identity-verification interaction does not create that relationship. A business is still a data broker as to personal information it sells that it collected outside a first-party interaction with the consumer.

Create the DROP account and complete applicable registration and fee steps. A business beginning brokerage after the registration period must create its account before operating, begin downloads within 45 calendar days of commencing operations, and register the following January. Then select every applicable list from the six types: name plus date of birth plus ZIP code, email, phone, mobile advertising ID, name plus VIN, and connected-TV identifier. Fewer lists are allowed only when identifiers across multiple lists lead to the exact same consumers in the broker's records.

For each download, standardize the broker's records, hash them under the current technical specification, and compare hashes locally. A match requires deletion of the associated information, including inferences, and instructions to service providers and contractors. Section 7613 excludes qualifying first-party information collected directly from the consumer and applicable exempt information; map those exceptions by record rather than deleting only the submitted identifier or exempting an entire profile. Where one matched identifier maps to multiple consumers, opt all linked consumers out of sale and sharing and direct downstream providers to do the same.

Report Deleted after completing the required matched-record deletion, Opted out for the shared-identifier outcome, Exempted only when all information related to the matched consumer is exempt, and Not found only after the required matching process finds no match. CalPrivacy's processing page explains the technical steps but labels itself guidance; the Delete Act and regulations control if the guidance and binding text differ.

The data-broker privacy or DROP operations owner should maintain the record. It must support the recurring download-process-report cycle and show why each request received its status without retaining raw DROP identifiers or suppression data beyond what ongoing compliance needs.

Review every cycle for missed downloads, unselected identifier lists, failed normalization or hashes, partial dataset coverage, wrong status codes, incomplete downstream action, and records collected again after deletion. Re-test after changes to identifiers, matching logic, data stores, acquisitions, vendors, or the official DROP technical specification.