🛡 Built for the California Delete Act (SB 362)

Your DROP deletion requests, handled — every 30 days (effective January 1, 2027), without the spreadsheet chaos.

dropsolace pulls California's DROP deletion lists, matches them against your consumer data with verifiable hashing, and walks your team through every step until the status report is filed.

Apply for access See how it works
Verified against the official CPPA hashing specification No PII stored — SHA-256 hashes only API & manual modes
The reality since August 1, 2026

DROP is mandatory. The clock is unforgiving.

Every registered data broker must access California's Deletion Request Outreach Platform (DROP), process consumer deletion requests, and report status — on a repeating 30-day cycle (effective January 1, 2027).

$200/day
Per unhandled deletion request
Civil penalties accrue daily for each request you fail to process and report on time.
30 days
From receipt to reported (effective 2027)
Download → match → process → report. Miss the window and you're out of compliance — then the next cycle starts.
6 list types
NDZ · Email · Phone · MAID · NameVIN · CTVID
Each list uses SHA-256 hashed identifiers. Matching them yourself means building a hashing pipeline to CPPA specs.
How it works

Four steps. We mirror the official process exactly.

dropsolace follows the CPPA's own workflow — the same steps, the same terms, the same file formats. Nothing to relearn.

1

Download deletion lists

Pull every list you're subscribed to with one click via API Connect — or upload the ZIP you downloaded from DROP.

Official step: "Download consumer deletion lists"
2

Match against your data

Upload a CSV of your consumer records. We standardize and hash them to CPPA specs, then match every request — verifiable, byte for byte.

Official step: "Standardize and hash their own consumer records"
3

Process each request

Decide person by person: deleted, exempted, or opted out. Changes to your data later? We flag amendments automatically.

Official step: "Match and process requests"
4

Report status to DROP

We generate the official Id,Status CSV with the correct filename — send it to DROP in one click, or download and upload it yourself.

Official step: "Report the status of each request in DROP"
Hashing, verified

Real-world data, hashed exactly the way CPPA expects.

A single missed match is a missed deletion. Our hashing engine handles the messy shapes real consumer data comes in — each category below is verified against the CPPA's own specification.

Names in any script

Greek, Cyrillic, and accented Latin names transliterate to the official mapping — 87 characters, aligned to the CPPA spec character by character.

International phone numbers

Any dialing format, any country prefix — normalized to the last 10 digits exactly as DROP's lists hash them.

ZIP & postal codes

ZIP+4 truncation, leading zeros stripped, Canadian alphanumeric postal codes — all reduced to the official five-character form.

Dates of birth

Written month names like July 4, 1776, ISO dates, or plain digits — all parsed to the YYYYMMDD the spec requires.

Device identifiers

MAID, VIN, and connected-TV IDs cleaned and length-checked to the CPPA's exact input rules.

Composite hashing

NDZ and NameVIN lists hash each field separately, then the hashes — assembled in the official order, step for step.

Every category is verified against the official CPPA test vectors — byte for byte.

Inside the product

One inbox. Your whole compliance cycle.

Every cycle lives on a single screen: the countdown, the four steps, the people waiting for a decision. No menus to hunt through, no state to keep in your head.

www.dropsolace.com/app/index
Compliance Dashboard — cycle countdown, four-step workflow, live status cards

The compliance dashboard: cycle countdown, four guided steps, and every pending decision in one place.

www.dropsolace.com/app/upload
Consumer Data upload with column mapping and privacy notice

Upload consumer data as a plain CSV. Columns are auto-detected; nothing leaves your workspace but hashes.

www.dropsolace.com/app/connection
DROP Settings — API Connect or Manual Upload mode

Two integration modes: API Connect for one-click pulls, or Manual Upload if you prefer working directly in the CPPA portal.

Why brokers choose us

Compliance help that assumes you're a broker, not a developer.

📄

Zero integration

No API project, no engineers. Export your data to CSV from Excel or your CRM, map the columns once, done. If you can attach a file to an email, you can use dropsolace.

🔬

100% verifiable hashing

Our hash engine is verified against the CPPA's official hashing specification — including transliteration, ZIP edge cases, and composite hashes. Every match can be independently verified.

🚦

Compliance gates built in

The rules from the Delete Act regulations are enforced for you: we block reporting mistakes before they happen and stop new downloads until the previous session is fully reported (§7614(a)).

⏱️

30-day cycle tracking (effective 2027)

A live countdown on every cycle, with warning states as the deadline approaches. Amendments get their own alerts so nothing slips past the deadline.

🚫

Suppression list management

Deletion is an ongoing duty: every deletion request you receive enters your suppression list — matched or not — blocking future sales and sharing automatically, with a full event history and removed-consumer handling.

🧾

Built for audit readiness

Every download, match, decision, and report is written to an append-only audit log. When a regulator asks how you handled a request, the answer is one export away.

Data minimization

We never store your consumer PII. That's the point.

dropsolace was designed around the CPPA's own PII-minimization principle: we hold only the irreversible hashes needed to match, and nothing more.

Hashes in, hashes out

Deletion lists arrive pre-hashed. Your uploads are hashed in your workspace the moment they're processed — original rows are never persisted.

Nothing sent to CPPA on your behalf

We only submit the status reports you approve. Your consumer records never leave the workspace in readable form.

Keys encrypted at rest

API keys are stored encrypted and shown masked after saving. Each workspace's data is isolated at the database level.

Get started

Start your first cycle before the next deadline starts it for you.

Tell us who you are and your CPPA registration number — we'll set up your workspace and walk you through the first download together.

Apply for access

Setup call optional · No credit card

FAQ

Questions brokers ask us

Is my customer data safe?

Yes. We never store your original data. Everything is hashed and used only to match against DROP deletion requests — Only irreversible hashes are kept, consistent with the CPPA DROP platform's PII-minimization principle.

I'm not technical. Can I really do this?

Yes — that's who dropsolace is built for. The Manual Upload mode needs no API key: download the ZIP from the DROP portal, upload it here, follow four guided steps. Column names in your CSV are detected automatically.

Do you submit anything to CPPA without my approval?

Never. In API Connect mode, "Report to DROP" is always a button you press. In Manual mode, you download the official CSV and upload it yourself. Either way, nothing is filed without your explicit action.

We already missed a cycle. Is it too late?

No — but start now. The duty restarts with your next access. dropsolace tracks the clock from your first download and keeps every subsequent cycle on schedule, including amendments for anything you previously reported as "Not Found."

How does pricing work?

Pricing is simple: three plans sized by the number of consumer records you manage — and never charges per deletion request.

Can I cancel anytime?

Yes — subscriptions renew automatically each billing period, and you can cancel at any time. Cancellation takes effect at the end of your current billing period. See our Terms of Use for details.