Start with four actions: confirm your partners are registered as data brokers, learn how removal requests will reach you, name one owner with a deadline, and consider whether a DPA (Data Processing Agreement) is needed with each partner. For systems, that means a place to receive files, a list of every system where a notice must be applied (CRM, marketing automation, ad platforms, and agency lists), and a record that you applied it. DROP’s windows are expected to move to 30 days on January 1, 2027, so plan for notices to arrive more often.

The build took us (HealthLink Dimensions) about four weeks, and several pieces each took real work: legal review, writing our own policies and process for DROP requests, revising our data protection agreement (DPA) for partners, testing our matches back and forth with DROP, and setting up a platform to send removal notices to partners downstream. The agreements and legal review took the longest.

California’s AB 883, signed September 27, 2026, shortens DROP’s 45-day download and reporting periods to 30 days, takes effect January 1, 2027. SB 923, signed the same day and also effective January 1, extends California deletion rights to information collected “from or about” a consumer. Connecticut’s SB 4, signed May 27, 2026, creates a state deletion mechanism similar to DROP, due July 1, 2028.

Yes. The main one is AB 883, which moves the 45-day windows to 30 days in January. Brokers will download and report more often, so partners should expect removal notices more often too. Other changes to watch:

• CalPrivacy approved a $9,500 registration fee for 2027, up from $6,000. Registration runs January 1–31, 2027.

• It’s likely that the kinds of identifiers DROP will accept will be expanded at some point, although within 90 days seems less likely.

CalPrivacy’s guidance is to delete the consumer’s non-exempt personal information, then keep only the minimum needed to screen newly collected records before they’re sold or shared. That list can’t be used for anything else, and the consumer doesn’t have to resubmit the request. At HealthLink, matched records come out of what we deliver, and we keep only what we need so those people aren’t collected again. What counts as the minimum for your business is a question for your counsel.

Most of our cycle is run by people today, so we haven’t automated it. DROP supports an API for downloading lists and reporting status, and it has a sandbox for testing. The sandbox includes a tool that checks your standardization and hashing against fake data, which is the best place to start.

DROP’s six lists are all hashed, exact-match identifiers: name with date of birth and ZIP, email, phone, mobile advertising ID, name with vehicle ID (VIN), and connected TV ID. A broker matches only against identifiers it holds in those forms.

Matching is an exact process for deletion. However, if one submitted identifier ties to more than one person, the broker opts each of them out instead of deleting (11 CCR § 7613(a)(2)(B)).

Probabilistic identifiers aren’t DROP list types (yet), so consumers can’t submit them and brokers don’t match against them. But once a person matches, CalPrivacy’s guidance says to delete all non-exempt personal information, including inferences about the consumer. This could also include probabilistic identifies associated with that consumer, but CalPrivacy has not issued specific guidance on this point.

Under the Delete Act, a broker must pass DROP deletions to its own service providers and contractors (Cal. Civ. Code § 1798.99.86(c)(1)(C)–(D)).

The Delete Act doesn’t name customers who buy or rent lists. You may still hear about deletions based on contract requirements, or through CCPA deletion requests, which carry their own duty to notify third parties.

From January 1, 2027, SB 923 extends the CCPA deletion right to data a business got from other sources. A vendor can’t sell or share a deleted person’s data again, so future rentals should exclude them.