California DROP readiness checklist

When must a broker access DROP?

The California duty to begin accessing and processing DROP requests started on August 1, 2026. It is no longer a future launch milestone.

Section 7612 requires access at least once every 45 calendar days. Preserve the last successful retrieval and next operating checkpoint.

Confirm data-broker coverage before applying this route. A readiness report cannot prove that a broker deleted records or reported their status.

Worked example. An expired retrieval token

Fictional example. Cedar Data’s automated job runs, but an expired token prevents a downloaded list. Record a failed retrieval, not a successful access.

Section 7612 requires manual download when automation cannot download on time. Preserve the manual retrieval evidence and corrective action.

Review any agency-notification duty against the actual failure facts. A scheduler log alone cannot establish that the operational duty was met.

Test the internal route with fictional identifiers. Do not submit a fabricated consumer request to the live DROP service.

Confirm that DROP is the right route

Record the data broker registration position and the facts supporting it. Keep the conclusion separate from the operational readiness check.

Map receipt to verified action

Document who retrieves requests, how identifiers are matched, how deletion reaches systems and suppliers, and how suppression prevents avoidable reacquisition.

• Account and access owner
• Request retrieval evidence
• Matching and exception record
• Deletion and supplier confirmation
• Suppression and audit evidence

Test the route before relying on it

Use a synthetic request through the complete operating route. Record failures, retries, completion evidence and the owner of each corrective action.

Working checklist and fictional samples

Use this checklist as an operating aid, not an exhaustive legal assessment. Inspect the samples before entering your own facts.

• Check account ownership, backup access and selected deletion lists.
• Test the manual fallback and preserve successful retrieval evidence.
• Check identifier preparation and matching under section 7613.
• Record deletion, permitted exceptions and supplier actions.
• Reconcile status reporting under section 7614 and failed items.
• Check security and the restriction against consumer verification contact under section 7616.

• Fictional DROP readiness PDF. Complete fictional pack (ZIP). Inspect readiness questions and actions. This is not proof of a completed deletion.