California DROP compliance, fully automated.

DROP stands for Deletion Request and Opt-out Platform. It’s a California law (SB 362, the Delete Act) that creates a centralized portal where consumers can request deletion of their data from all registered data brokers at once. California publishes six distinct hashed deletion lists every 45 days, and registered data brokers must match, delete, and report back.

No. DROP is fundamentally different from a standard DSR. California acts as the intermediary, submitting batch deletion requests on behalf of consumers. Your existing DSR process handles consumer-initiated requests. DataGrail Data Broker Compliance is purpose-built for the DROP batch process and works alongside your existing DSR workflows.

Penalties start at $200 per consumer per day with no cap. The CPPA has enforcement authority and has signaled it intends to use it. Given the volume of requests already submitted (250,000+), the exposure for non-compliant brokers compounds quickly.

You can, but it’s a significant engineering project: DROP API integration, California’s exact hashing specification, matching logic, status reporting, and ongoing suppression list maintenance. DataGrail provides open-source libraries and a mock DROP server for teams that want to pre-hash, but most data brokers don’t want to own this workstream long-term.

DataGrail never stores PII in plaintext. All data is encrypted using a per-customer AWS key that never leaves AWS. Matching is hash-to-hash, so no actual names or emails are exchanged with California. If a customer offboards, DataGrail destroys their encryption key in one step, making all stored data permanently unreadable, including backups.

This is exactly what DataGrail is built for. Data Broker Compliance connects to all your SaaS, cloud, and internal sources, reads identifiers from each, and the subject resolver handles whether the same person appearing in different systems should be treated as one deletion or multiple.

The §7613 exemption handles this automatically. Data collected through a direct first-party relationship — signups, purchases, direct subscriptions — is exempt from DROP deletion. You declare the §7613 status for each integration during setup, and DataGrail applies the exemption on every matching cycle.

DataGrail can walk through the qualification criteria with your team, but cannot provide legal advice. The best path is for your legal or compliance team to review the California data broker definition against your business model. Common in-scope use cases include marketing and advertising data, people search, financial enrichment, location and mobile data, and identity resolution.