California's DROP Is Deleting Data Broker Records: What It Means for Client Prospect Lists

Since August 1, 2026, registered data brokers have had to pull deletion requests from a single state platform and act on them. The platform is California's Delete Request and Opt-out Platform, or DROP. According to CalPrivacy, more than 550,000 Californians had signed up by the start of October.

For agencies that build client lists from contact data vendors, this is not abstract. A client's next list may include business contacts who have asked every registered data broker in the state to delete them. Whether those records still show up depends on the vendor, and on what your team does with data it already pulled.

This post covers what DROP requires, why it reaches B2B contact data, and four changes we would make to every client's list process. It is not legal advice. Clients with large California volume should ask their own counsel how the Delete Act applies to them.

What DROP is

California's Delete Act created a way for a resident to send one deletion request to every registered data broker at once. The state built DROP to carry it. Consumers verify California residency, enter identifiers like email address and phone number, and submit once. CalPrivacy says more than 650 registered data brokers are covered.

Data brokers, in turn, must:

• Access DROP at least once every 45 days, starting August 1, 2026, and download the deletion lists that match the data they hold.
• Match the hashed identifiers against their records, delete non-exempt personal information for each match, and report a status for every request within 45 days.
• Direct their own service providers and contractors to delete the same records.
• Keep checking. If a broker later collects data on someone who already filed a DROP request, the broker has to delete it then. The consumer never has to ask again.

The penalty CalPrivacy cites for a broker that fails to delete is $200 per day per consumer, plus investigation and enforcement costs.

CalPrivacy also reported early results. In the first three months of processing, 99% of DROP users had their information deleted by at least one data broker, and 70% had it deleted by 100 or more.

Why this reaches B2B contact data

It is tempting to read this as a consumer privacy story about people-search sites. It is not limited to that.

California's privacy law used to carve out personal information collected in a business-to-business context. The California Attorney General's CCPA FAQ says those exemptions expired on December 31, 2022. A business contact who lives in California is a "consumer" under the law, and a work email address is personal information.

DROP's deletion lists include an email address list. A broker that sells business contact data and holds a matching work or personal email has to process the request like any other.

There is one carve-out to keep in mind. CalPrivacy's FAQ notes that some information is exempt from deletion, such as information a consumer gave a broker directly or publicly available information like public records. So a DROP request does not wipe every trace of a person. It does remove a lot of what list vendors sell.

What changes for agencies

None of this makes a client's list illegal by default. It changes what "fresh data" means and what you should ask vendors. Four changes we would make:

1. Ask each data vendor whether it is a registered California data broker and how it processes DROP. The state publishes a data broker registry. If a vendor is registered, ask how often it downloads DROP lists and how fast deletions reach the records you pull through its API or exports. A vendor that cannot answer is telling you something.
2. Stop treating old exports as permanent. A broker deleting a record does not reach into a CSV your team downloaded in June. Anchor every contact's retention to the date it was collected, and re-check against the vendor before a dormant segment goes back into a sequence. A record that has vanished upstream is a signal, not a nuisance.
3. Do not re-add a person you suppressed. DROP is built on the idea that a person's request holds over time. The CCPA regulations on deletion allow a business, service provider, or contractor to keep a record of a request in order to make sure the information stays deleted. Your client's suppression list should do the same job: once someone is out, a fresh import from a different vendor should not quietly bring them back.
4. Route direct requests to the client. DROP goes to data brokers. Prospects can still email your shared inbox asking what data you hold or asking to be deleted. The Attorney General's FAQ says it is the business, not its service provider, that answers those requests, generally within 45 calendar days. Write into each client's playbook who receives these and how fast the reply team suppresses the contact while the client responds.

The honest takeaway

Most agencies will not feel DROP as a single event. They will feel it as slightly smaller match rates on California contacts, the occasional record that disappears between pulls, and a few more privacy replies in the inbox. The agencies that handle it well are the ones that can say, for any contact, where it came from, when, and whether that person ever asked to be left alone.

Where GTM fits

GTM keeps provenance on every field, anchors retention to the collection date, and keeps suppression in place even after a record is purged, inside an isolated workspace per client. GTM is US-only today, its data model is built to GDPR, and CCPA controls are still being verified, so treat this post as process advice, not a compliance claim.

If you run outbound for several clients and want source trails and suppression that hold up, join the waitlist.

Sources

• CalPrivacy, "DROP FAQ: 10 Common Questions about DROP" (October 6, 2026): https://privacy.ca.gov/2026/10/drop-faq-blog/
• CalPrivacy, "Processing DROP requests": https://privacy.ca.gov/drop-for-data-brokers/process-drop-requests/
• California Privacy Protection Agency, "Information for Data Brokers": https://cppa.ca.gov/data_brokers/
• California Attorney General, "California Consumer Privacy Act (CCPA)" FAQ: https://oag.ca.gov/privacy/ccpa
• Cal. Code Regs. tit. 11, § 7022, "Requests to Delete" (LII): https://www.law.cornell.edu/regulations/california/11-CCR-7022