The First DROP Cycle Closes in Mid-September. Nobody Is Going to Email You About It.
If you filed a DROP request with the State of California, the first mandatory processing cycle is closing right about now — and the most useful thing to understand about it is that you are not a party to it.
Not in a cynical sense. In a structural one. The Delete Act's reporting runs from the broker to the regulator. It does not run from the broker to you.
What actually started on 1 August
The Delete Act (SB 362) built the Delete Request and Opt-out Platform, DROP, at privacy.ca.gov/drop. Consumers have been able to file since 1 January 2026. What changed on 1 August 2026 is the obligation on the other side: from that date, every registered data broker must access DROP and process the deletion list.
Brokers must access the platform at least every forty-five days. Count forty-five days from 1 August and you land in the middle of September. That is the close of the first cycle in which a broker's inaction is a compliance fact rather than a runway.
Three things about that cycle that surprise people
One: the broker never sees your details in the clear. CalPrivacy hashes consumer identifiers before brokers retrieve them. A broker downloads hashed values and matches them against hashes of what it already holds. It is a matching exercise, not a disclosure of a new list of Californians.
That design is deliberate and it is good — a deletion platform that handed every registered broker a fresh, clean roster of verified California residents would have been an astonishing own goal. But it has a consequence worth sitting with: matching is where the outcome is decided. If a broker holds you under a maiden name, a former address, a misspelling, or an email you no longer use, the hash of what you filed and the hash of what it holds do not agree, and nothing happens. No error is raised. From the platform's point of view the request was processed.
Two: the report goes to the agency, not to you. Brokers report their processing status to CalPrivacy. There is no statutory requirement that a broker tell the consumer anything. You will not get a confirmation email, a per-broker breakdown, or a list of who found you and who did not. If you have been waiting for one, that is why it has not arrived.
Three: deletion is ongoing, not a one-time sweep. Once a request is processed, the broker's obligation extends forward — it must also delete information about you that it acquires later. That is the part of the Delete Act that actually engages the industry's habit of re-listing people after a removal, and it is the reason a DROP request is worth more than a single opt-out form.
So how would you ever know?
You would look.
This is the part where I have to be careful, because it is also the part where I have a business, so read the next two paragraphs with that in mind.
What is checkable from outside a broker is whether a named individual's information is publicly indexed at a named website at a given moment. That is an observation, and it has three honest outcomes: INDEXED, NOT INDEXED, or INDETERMINATE — the third being far more common than vendors like to admit, because sites go down, block automated retrieval, or return ambiguous pages.
And here is the limit that matters, stated plainly: index presence is not proof that a deletion request was ignored, and index absence is not proof that data was deleted. A record can sit in a broker's database and never be surfaced publicly. A public listing can vanish for reasons that have nothing to do with your request. What a check gives you is a dated observation, and a series of dated observations gives you a record. It does not give you the inside of anyone's database, and anybody who tells you otherwise is selling you something worse than nothing.
The useful version of "how would you know" is therefore modest and real: take an observation now, at the close of the first cycle, and take another one later. A dated pair is evidence of a change. A single glance is an anecdote.
What to do this month if you are a Californian
- If you have not filed, file. DROP is free at privacy.ca.gov/drop. Anyone charging you a fee to "submit your DROP request" is charging for a state form.
- Go back and widen your profile. Because the platform matches on hashed identifiers, the identifiers you supplied are the entire surface area of your request. Old addresses, former surnames, the email you used in 2011, the phone number you gave up — every one you add is another chance for a hash to agree with a broker's records. This is the single highest-leverage thing most filers have left undone.
- Do not expect correspondence. See above.
- Understand what DROP does not reach. Non-broker businesses that collected from you directly, unregistered and offshore people-search sites, breach corpora already in circulation, and government records are all outside it. Those are separate rails with separate tools.
Frequently asked questions
When exactly does the first cycle close?
The obligation to process began 1 August 2026, and registered brokers must access DROP at least every forty-five days. That places the outer edge of the first mandatory access window in mid-September 2026. Individual brokers may access more often; the statute sets a floor, not a schedule.
Will a data broker confirm that it deleted my information?
There is no requirement that it tell you. Processing status is reported by the broker to the California Privacy Protection Agency. If you want an outside signal, the observable thing is public indexing, with the limits described above.
Why did nothing appear to change after I filed?
Several possibilities, and they are not distinguishable from the outside: the broker never held you; the identifiers you filed did not match what it holds; it processed the deletion but you are looking at a site that is not a registered broker; or the record was deleted from the database while a cached or syndicated copy persists elsewhere. This ambiguity is a real feature of the landscape, not a hedge.
Is DROP free?
Yes. It is a state service. There is no fee and no premium tier.
I am not a California resident. Does any of this reach me?
DROP eligibility requires California residency. Other states have deletion rights and, in several cases, broker registries, but no state has yet stood up a comparable central request platform.
Disclosure
I run Sirveil, a small California company whose service determines whether a named individual's information is publicly indexed at a named website at a given moment, and reports that observation as INDEXED, NOT INDEXED, or INDETERMINATE. We do not verify that anyone complied with anything, and we do not audit or certify anyone. I have a commercial interest in how deletion and verification get regulated and I disclose it wherever I write.
Sources: SB 362 (Chapter 709, Statutes of 2023); California Privacy Protection Agency DROP materials at privacy.ca.gov/drop. Read 5 September 2026.
NONE OF THIS CONSTITUTES LEGAL ADVICE. The author writes as a commercial party with a disclosed interest, not as counsel. Dates and obligations are cited as published; confirm them with the agency and with your own counsel.