DROP and the Data-Broker Version of a Privacy Request

California’s Delete Request and Opt-out Platform, or DROP, shows why a browser signal cannot stand in for every privacy workflow. The 2026 data-broker rules focus on a verified, centralized deletion request that must be delivered to businesses holding information collected outside a direct first-party relationship. This chapter follows that request from consumer submission through a broker’s recurring intake, record matching, deletion or sale suppression, downstream instructions, and status reporting. The reader should be able to see why hashed identifiers and repeated reconciliation are legal mechanisms, not merely implementation choices.

DROP is therefore adjacent to the browser-signal model, not its automatic destination. A browser signal reaches a business or controller during an online interaction and communicates a defined opt-out purpose. DROP begins with a consumer submitting a deletion request through a platform, after California residency is verified, and sends data brokers the information needed to match that request to records. The distinction determines who receives the request, what identity evidence is used, and what counts as completion.

A verified request enters a broker’s recurring intake

The California rules define DROP as the accessible deletion mechanism required by Civil Code section 1798.99.86. A consumer must submit the deletion request through DROP. The Agency verifies California residency before the consumer can submit; if the Agency cannot verify residency, the consumer cannot proceed through the platform, subject to the review process described in the rules. The consumer may add information that helps brokers find the relevant records, including a date of birth, email address, phone number, or a pseudonymous identifier such as a mobile advertising identifier.

This entry point is different from a browser signal in two ways. First, the platform performs a residency check before the request enters the broker workflow. Second, the consumer can supply identifiers for matching because the request is designed to reach records that may not be connected to the consumer’s current browser or to a first-party account. By submitting the request, the consumer consents to disclosure of the relevant personal information to a data broker for the purpose of processing the deletion request. That consent is tied to the statutory workflow and can be canceled or amended under the rules’ timing conditions; it is not a general permission for the broker to use the information commercially.

The direct-relationship definition explains why this centralized path matters. A consumer does not have a direct relationship with a business merely because the business collected information directly at some point. The consumer must have intentionally interacted with the business to access, purchase, use, request, or obtain information about its products or services. Exercising a privacy right is not itself that kind of first-party interaction. A business can therefore remain a data broker with respect to information collected outside a first-party interaction even if it has some other information that came directly from a consumer.

Once a business qualifies as a data broker, it must create a DROP account before accessing the platform. The account identifies the broker, its contacts, public-facing information, and the consumer deletion lists it will retrieve.