Surfaced the NBC 7 Responds segment framing DROP as a consumer win: one form now reaches ~500 registered brokers, replacing the effectively impossible task of filing individually with each. The 45-day deletion window plus recurring re-check requirement is presented as the mechanism that finally makes CCPA's delete right meaningful for ordinary Californians.
Argues the NBC framing undersells the news. The combination of $200/day registration penalties, $10,000-per-violation deletion penalties, and the 45-day re-check cadence converts CCPA compliance from a legal-footer checkbox into an ongoing engineering requirement — deletion lists must now be reprocessed continuously against newly-acquired records, not handled as one-shot events.
Notes that the statute's authorized-agent provision is spawning a competitive second-order market, with Consumer Reports' Permission Slip, Optery, DeleteMe, and startups racing to become the default DROP-authorized-agent layer. Most consumers will never touch the CPPA portal directly — they'll delegate, which shifts leverage toward whichever agent aggregates the most requests.
As of August 1, 2026, California's Delete Request and Opt-Out Platform — mercifully shortened to DROP — is enforceable. It's the operational half of the 2023 DELETE Act (SB 362), and it does something no prior US privacy law has managed: it collapses the right-to-delete into a single form. One request, submitted through the California Privacy Protection Agency's portal, propagates to every data broker registered with the state. The broker then has 45 days to delete the requester's data, and must re-check the DROP list every 45 days thereafter to scrub any newly-acquired records for the same person.
Before DROP, exercising your CCPA delete right meant filing individually with each of the roughly 500 brokers on California's registry — a full-time job that virtually nobody completed. The NBC 7 Responds segment that surfaced this on Hacker News framed it as a consumer-protection story, but the real news is the enforcement architecture. Brokers that fail to register with the CPPA face $200 per day in penalties. Brokers that fail to honor a DROP request face $10,000 per violation, plus investigation costs. The CPPA has already been fining unregistered brokers throughout 2024 and 2025 — the enforcement muscle is warm.
The portal itself is deliberately boring: name, aliases, email, physical address, optional phone. Requesters can authorize an agent to file on their behalf, which is where the interesting second-order market forms — Consumer Reports' Permission Slip, Optery, DeleteMe, and a handful of startups are all racing to become the default DROP-authorized-agent layer.
If you've been treating CCPA and its cousins (CPRA, VCDPA, CPA, CTDPA) as a compliance checkbox handled by legal — mostly by pasting a `Do Not Sell My Info` link in your footer — DROP is the moment that abstraction leaks into your data pipeline. The 45-day re-check requirement means the deletion list is no longer a one-shot event you process; it's a subscription your ingest layer has to maintain in perpetuity. Every time your enrichment vendor delivers a new batch of contacts, you have to diff it against the DROP list before it hits your warehouse. Every time you buy a lead list, same thing.
Compare this to how GDPR's Article 17 played out. Erasure requests in the EU are still largely one-to-one — you file with each controller, and controllers are only obligated to notify downstream processors "where possible." In practice, that meant plenty of European consumer data sat in enrichment databases for years after the subject asked to be forgotten. DROP short-circuits that by moving the propagation into the regulator itself. The broker doesn't have to hear from the consumer; it has to poll a state-run list.
The technical implication for brokers is straightforward and unpleasant: you need a stable, deterministic identity-resolution layer that can match a name + email + address tuple against every record you hold, across every schema, every 45 days, forever. For companies whose entire business model is fuzzy identity resolution across low-quality inputs — which describes most of the ad-tech and people-search industry — this is closer to an existential question than a compliance line item. Several brokers on the CPPA registry are already publicly discussing exiting the California market rather than build the infrastructure.
There's a second-order effect worth naming. LLM training corpora scraped from broker-adjacent sources — the endless "public records aggregation" sites that dominate Google results for a person's name — are the exact substrate that models like GPT-4 and Claude memorized during pretraining. DROP doesn't reach into the weights of a trained model, but it does apply to the ongoing scraping pipelines that feed retraining. If you're building anything RAG-flavored on top of people-search data, your rug is now getting pulled on a rolling 45-day cycle by the state of California.
The HN thread on the NBC story surfaced a predictable split: privacy advocates cheering, ad-tech engineers pointing out that the definition of "data broker" under SB 362 is narrower than the public discourse suggests (it excludes entities with a direct consumer relationship, which is why Meta and Google technically aren't on the list), and a small chorus noting that the CPPA is chronically under-funded relative to the industry it's regulating.
Concretely, if you ship anything that touches third-party consumer data, three things change on your roadmap this quarter.
First, your data ingest needs a DROP-diff step. The CPPA publishes the request list to registered brokers via a secured feed; if you're a broker, integrating that feed and running the diff before ingest is table stakes. If you're a downstream consumer of broker data — a SaaS that enriches contacts via Clearbit, ZoomInfo, Apollo, or similar — you should be asking your vendor for their DROP compliance attestation in writing, because their deletion obligation becomes your data-quality problem. Records you enriched last month may be legally required to disappear this month.
Second, your data retention policy needs a 45-day heartbeat. This is uncomfortable for anyone running an event-sourced or immutable-log architecture, because DROP compliance requires actual deletion, not just tombstoning. Snowflake, BigQuery, and Databricks all have soft-delete-then-hard-delete workflows now specifically for this pattern, but if you're on a bespoke data lake, you're writing the machinery yourself. Immutability is a great architectural property right up until a regulator makes mutability mandatory on a rolling clock.
Third, your identity graph needs deterministic keys, not just probabilistic ones. A DROP request arrives as `name + address + email + optional phone`. If your matching layer produces false negatives on stale addresses or nickname mismatches, you're non-compliant. If it produces false positives, you're deleting the wrong person's data, which is its own liability. The industry has spent a decade optimizing identity resolution for ad targeting (high recall, tolerable precision); DROP inverts the objective function.
California sets the floor, but Colorado, Oregon, and Texas all have broker-registry bills in various stages of markup that explicitly reference the DELETE Act's architecture. By late 2027, expect a de facto national DROP standard — not because Congress passes anything, but because no vendor will maintain a fifty-state matrix of subtly different deletion feeds. The engineering work you do to comply with California this year is the work you'll ship everywhere else next year. The brokers that treat this as a compliance nuisance will spend 2026 firefighting; the ones that treat it as a data-architecture rebuild will still exist in 2028.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.