The California DROP Act

Complying with the DROP Act (SB 362) is simple with Optacy.

As a registered data broker, you are required to retrieve consumer deletion requests from California’s Delete Request and Opt-Out Platform (DROP) every 45 days. Optacy automates this by connecting directly to your DROP account via API to download the latest batch of hashed identifiers (SHA-256). We automatically match that list with your data, and automatically create delete/opt-out requests on your Optacy account to automatically fulfill and prove your compliance.

How it works to connect Optacy with your Drop Account:

  1. Secure Matching: You provide Optacy with an export (e.g., to an S3 bucket, or database) of your own hashed customer identifiers.
  2. Zero-Knowledge Comparison: We match the state’s request list against your hashes. We never need to see your customers’ plain-text names or emails.
  3. Automated Deletion: For every match found, Optacy triggers a privacy request in your Optacy account. Our integrations then ‘delete’ the data across your connected services (CRM, Data Warehouse, etc.) using the hashed ID as the primary key.
  4. Permanent Suppression: We add all IDs to an aggregated Suppression List to ensure that if you acquire new data in the future, those consumers are automatically blocked from re-entering your system which is a mandatory requirement of the Act. This suppression list is available and published back to the same export method (e.g., to an S3 bucket, or database) of your choosing for you to gate access to this data.
  5. Optional: if you require an API to check the suppression, that is something we offer as well.
  6. Additional method of verifications: Your system may require an additional verification method before deleting any customer data, please inquire about our second point of contact verification if needed.

Proving Compliance: We close the loop by reporting the fulfillment status of each request back to the CPPA. Additionally, Optacy simplifies your mandatory July 1st annual disclosure. Our dashboard automatically generates the metrics you need to display on your website, including:

  • Total requests to Delete, Know, Opt-out, Correct, and Limit.
  • The number of requests fulfilled vs. denied.
  • The mean and median response times for each request type.

The advantage of Optacy is that we seamlessly bridge the gap between the state’s portal and your existing data services. If you already use our webform, every direct deletion request is automatically synced to your DROP suppression list, keeping your entire privacy stack unified and audit-ready.

How to Get Started: Connecting Your Optacy & DROP Accounts

Integrating your systems with California’s state portal doesn’t require a heavy engineering lift from your team. We’ve designed Optacy to onboarding data brokers in two simple phases:

Phase 1: Zero-Risk Testing in the CPPA Sandbox

Before pushing anything live, we want to ensure your database matching and automated deletion workflows are flawless.

  1. Log into your CPPA Developer Portal and navigate to your credentials tab.
  2. Generate an API Key for the DROP Sandbox environment.
  3. Reach out to support to enable integrations in your Optacy account
  4. Securely paste that key into your Optacy Dashboard under Integrations.

With the sandbox key active, Optacy will run safe, simulated “demo” runs. You can watch your data layers process mock deletion lists, test your S3 bucket pipelines, and verify that the automated suppression mechanics are working perfectly—all without touching live production data.

Phase 2: Flipping the Switch to Live Compliance

Once you’ve validated your workflows and are ready for the mandatory enforcement window, transitioning to production takes seconds:

  1. Generate your production DROP API Key from your official, registered CPPA broker account.
  2. Swap out the Sandbox key in Optacy for your production key.

Once activated, every 45 days, our system will communicate with the state, ingest the newest batch of encrypted consumer hashes, sweep your data architecture, log the fulfillment metrics for your website’s compliance widget, and report the success tokens directly back to the CPPA’s API.

Conclusion

Reach out if you are a data broker and require a solution for high volume of requests. We offer very competitive pricing and an extensive integration platform. And, we look forward to helping you with your new DROP requirements.