California's DROP: what it means for privacy ops teams

TL;DR: California's Delete Request and Opt-Out Platform (DROP) creates a recurring deletion obligation for businesses that buy, sell, or share consumer data, with annual registration, 45-day request retrieval, and enforcement starting August 1, 2026, according to Ketch. Manual DSR workflows will struggle once deletion must cascade across backend systems, downstream partners, and consent signals on a fixed cadence.

Editorial analysis by NHI Mgmt Group, based on content published by Ketch: “DROP is live. Here's what California's new data deletion platform means for your business”.

Key questions

Q: What breaks when consumer deletion rights are handled with manual DSR workflows?

A: Manual workflows break when request volume becomes recurring and the organisation must coordinate identity matching, deletion, partner propagation, and proof of completion across many systems.

Q: Why does consumer deletion compliance depend on data mapping and lineage?

A: Because you cannot delete, suppress, or evidence what you have not discovered.

Q: What are the signs that consent management and deletion processing are out of sync?

A: The clearest sign is when a deletion request is completed in the database but browser tags, ad platforms, or downstream enrichments continue to operate.

Practitioner guidance

• Confirm whether you are a data broker Review whether the business knowingly collects and sells personal information outside a direct consumer relationship, including data enrichment and resale models.
• Map consumer data across all systems and partners Identify where personal data, inferences, and suppression state exist in CRMs, warehouses, ad tech, service providers, and contractor environments.
• Automate recurring DSR retrieval and execution Replace spreadsheet-based fulfilment with a workflow that retrieves requests on the 45-day cycle, matches identities, triggers deletion, and records completion.

Bottom line: DROP turns consumer deletion from a one-off privacy request into a recurring operational obligation with hard deadlines and downstream accountability.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →