Never miss a 45-day DROP cycle

The deadline, and what missing it costs

California's Delete Act gave registered data brokers a permanent, repeating obligation — not a one-time project.

• You must access DROP at least once every 45 calendar days to download your consumer deletion lists (11 CCR §7612(a)).
• You must process every deletion request within 45 days of receiving it, and direct your service providers and contractors to delete too (Civ. Code §1798.99.86(c)(1)).
• You must then re-delete that consumer’s information every 45 days, indefinitely, and never sell or share newly collected information about them (Civ. Code §1798.99.86(d)(1)–(2)).
• At every access session you must report a response code for each request from the previous session, before downloading the next list (11 CCR §7614(a)–(c)).

The fine is $200 for each deletion request, for each day you fail to delete as required, plus the Agency’s investigation costs (Civ. Code §1798.99.82(d)). It multiplies by requests and by days: 100 missed requests for 30 days is $600,000.

Failing to register separately costs $200 per day plus the fees owed (Civ. Code §1798.99.82(c)).

What Tideward DROP does

Downloads your lists on schedule.

Every 45 days, automatically, across all six list types you have selected — NDZ, Email, Phone, MAID, NameVIN, CTVID — plus the Removed file that tells you which identifiers were withdrawn.

Hashes your records inside your own environment.

A small tool you run against your own database produces SHA-256/Base64 hashes. Only hashes, work-item IDs, statuses and timestamps ever reach Tideward DROP. Your consumer data never leaves your systems.

Gets the composite hash right.

The regulation’s worked example and the official DROP API specification do not describe NDZ and NameVIN standardization the same way. Follow only the regulation text and your hashes silently fail to match — meaning you under-delete and accrue $200 per request per day without ever seeing an error. Tideward DROP implements both and reconciles them.

Files your status uploads correctly, on time.

Response codes 2 Exempted, 3 Deleted, 4 Opted out, 5 Not found — uploaded before your next download, in the required machine-readable format.

Keeps the permanent suppression set and an audit file.

Every cycle is logged immutably, including re-deletion sweeps and new-data suppression checks, so the evidence exists for the independent third-party audit that begins January 1, 2028 (Civ. Code §1798.99.86(e)).

Who this is for

Registered California data brokers who have no dedicated privacy engineering team — firms where DROP compliance currently lands on one developer, one operations lead, or a spreadsheet.

Of the 603 brokers registered for 2026, roughly 375 reported fewer than 1,000 deletion requests in their last filing and are not FCRA, GLBA or HIPAA regulated. That is who we built this for. If you have a privacy team and an enterprise suite, you are already served.

Why you can check this yourself

Every number on this page cites its source.

The 45-day cycle, the response codes, the $200-per-request-per-day penalty and the 2028 audit requirement are each tied to the Civil Code section or the 11 CCR rule they come from. Nothing here rests on our summary of the law.

We could not leak your consumer data if we tried.

Hashing runs on hardware you control. The service holds SHA-256/Base64 hashes, DROP work-item identifiers, response codes and timestamps — not names, addresses, emails or VINs. That is a design constraint, not a setting.

The hard part is the part we tested first.

The composite-hash mismatch between the regulation text and the v1.2.0 API specification is the failure mode that produces silent under-deletion. Reconciling it is the first thing Tideward DROP was built to do.

Price

No setup fee, no annual contract, cancel any time. For context, you already pay California $6,000 a year to register, so Tideward DROP costs a small fraction of a fee you are already paying — and a fraction of one day of one missed request.

Questions

Do you ever see our consumer data?

No. Hashing runs locally, on hardware you control, against your own database. Tideward DROP receives only SHA-256/Base64 hashes, DROP work-item identifiers, response codes and timestamps. We could not reconstruct a consumer record from what we store, and we do not want to be able to. That is a deliberate design choice, not a configuration option.

Who holds our DROP API key?

You do, by default. The local component authenticates from inside your environment. Whether a contracted service provider may hold a broker’s key is not yet settled. Tideward DROP is designed so the question does not have to be answered in your favour.

We already use a privacy suite. Why add this?

Most suites treat DROP as one workflow inside a broad consent-and-rights platform, priced by quote and sold to firms with compliance teams. Tideward DROP does one thing: the 45-day cycle, correctly, at a published price. If your suite already closes your cycle and produces your audit file, keep it.

What happens on the 2028 audit?

Beginning January 1, 2028 and every three years after, registered brokers must undergo an independent third-party audit, and must produce the report within five business days of a written Agency request and retain it six years (Civ. Code §1798.99.86(e); §1798.99.82(b)(2)(U)). The Tideward DROP per-cycle log is built to be that evidence.

Is this legal advice?

No. Tideward DROP is software. It implements the technical requirements of the DROP regulations and gives you the records to show your work. Your compliance obligations remain yours.

What if DROP changes?

The API specification is at v1.2.0 and the Agency is still issuing rules — audit regulations entered formal rulemaking on August 7, 2026. Specification tracking is included in both tiers, not an upgrade.