Your data never leaves
The agent runs inside your infrastructure. We never receive consumer data or your DROP API key.
Pre-launch · onboarding founding pilots
The California DROP deletion cycle, run on your own servers.
EraseCycle is software for small and mid-size data brokers, now in founding pilots. It downloads your DROP lists, hashes your records to the state’s exact spec, deletes or opts out every match, reports each status back, and keeps the evidence your audit will ask for. Consumer data never leaves your infrastructure.
One record, hashed the way DROP does it
CalPrivacy examples
- First name
- Daniellebecomesdanielle
- Last name
- Johnsonbecomesjohnson
- Date of birth
- July 4, 1985becomes19850704
- ZIP
- 91790-3771becomes91790
Each field SHA-256 → Base64, joined, then hashed again
NDZ hash (name + date of birth + ZIP) PQOfn1RffEKmqMmNAzDKKaoZCwxWbQZkQzPWmQo9REA=
Why now
The cycle shortens on 1 January 2027. Penalties are counted per request, per day.
DROP opened to consumers on 1 January 2026, and more than 325,000 people had signed up by July. Every registered data broker has to screen those requests against its own records, on a fixed schedule.
AB 883 · from 1 Jan 2027
30days
Brokers must process DROP requests at least every 30 days, down from every 45 days today.
Per request, per day
$200
For each deletion request a broker fails to process, according to law-firm summaries of the Delete Act.
Independent audits
2028
Third-party audits are required from 1 January 2028, then every 3 years. Every cycle will need evidence.
Brokers start processing DROP requests, at least every 45 days
At least every 30 days (AB 883)
Annual registration deadline
Independent audit required, then every 3 years
Registration must disclose audit status
Enforcement has started. CalPrivacy has announced settlements with data brokers from $34,400 to $110,490, mostly for failing to register. In August 2026 one broker was also ordered to process its DROP requests.
Sources: 2024 settlements · LocateSmarter (CalPrivacy) · Cybba (Governor’s office) · $200/day (Fenwick)
The gap
DROP hands you a list of hashes. Matching them is on you.
“No raw personal information is stored in DROP or ever shared with data brokers.”
CalPrivacy
The state never sees your database, so matching has to happen inside your systems. That is by design, and it is the part nobody hands you.
What CalPrivacy provides
To every registered broker
- DROP portal for manual list download and status upload
- API, webhooks and email notifications
- Sandbox with synthetic data and a hashing check (registered brokers only)
- Written spec, examples and code snippets
What’s left to you EraseCycle runs this
On your own infrastructure, every cycle
- Software that runs on your own data
- Connecting to your databases, files or CRM
- Standardizing and hashing your records
- Matching, deleting and opting out
- Notices to service providers and contractors
- Suppression list and screening before every sale
- Scheduling, failure alerts and audit evidence
How it works
One agent on your server. Seven steps. Every cycle.
EraseCycle installs as a small agent inside your infrastructure. It connects to your data (CSV files, Postgres, BigQuery or Snowflake to start) and runs the cycle on schedule. We’re building it with our founding pilots, who run their first cycles hands-on with the founder.
- Runs on
- Your servers
- Your DROP API key
- Stays with you
- Consumer data sent to us
- None
- Exemption decisions
- Yours
-
Download
Fetches new and amended requests for every list you hold, plus the “Removed” file for withdrawn requests.
EmailPhoneMAIDNDZNameVINCTVID -
Standardize and hash
Formats your records exactly to the published spec, then hashes them, including the composite rules for NDZ and NameVIN.
SHA-256 → Base64UTF-8 -
Match
Compares DROP’s hashes with yours inside your infrastructure. Unmatched requests are kept, so new records can be screened against them later.
-
Delete or opt out
One match: delete all non-exempt personal information, including inferences. One identifier linked to several consumers: opt them all out of sale and sharing. You review exemptions; the agent applies your decisions.
-
Notify
Directs your service providers and contractors to delete or opt out, and keeps proof that you did.
-
Report
Reports a status for every request within 45 days of download, and corrects earlier reports through the amend endpoint.
2 Exempted3 Deleted4 Opted out5 Not found -
Suppress and record
Keeps your suppression list, screens new data against it before every sale or share, and logs each cycle as evidence for the audit.
Then it runs again, at least every 30 days from 1 January 2027, and alerts you if a cycle fails or a deadline is close.
Why EraseCycle
Built for brokers without a privacy team.
Most registered brokers are small: the median broker received 81 deletion requests in 2024. EraseCycle is designed to be run by one engineer, not a privacy department.
No privacy team needed
Set it up once. Cycles run on schedule, and you get an alert if one fails or a deadline is close.
Audit-ready from cycle one
Every download, match count, action and upload is recorded for the independent audits that start in 2028.
Hands-on pilot
Founding pilots get direct help from the founder: mapping data sources and running the first cycles together.
Pricing
One plan while we’re in pilot.
EraseCycle is pre-launch. We’re onboarding a small number of founding pilots and building the agent around their real setups. Founding pilots shape what gets built first and work directly with the founder.
- Your DROP account, in your company’s own nameThe rules require the account to belong to the broker.
- Your API key, on your own serverWe don’t need access to your DROP account.
- Every exemption decisionThe agent flags possible exemptions; you decide.
Founding pilot
Pre-launch$299/ month
Cancel anytime.
- Hands-on setup: we map your data sources with you
- Scheduled DROP cycles with status reporting
- Suppression (do-not-sell) list and service-provider deletion notices
- Audit log of every cycle
- A direct line to the founder
“Ask about a pilot” opens your email app, addressed to the founder.
FAQ
Questions brokers ask
Something else? Email hello@erasecycle.com and you’ll hear back from the founder.
Is EraseCycle available today?
Not generally. EraseCycle is pre-launch. We’re onboarding founding pilots at $299 a month and working with each one directly: mapping their data and running their first cycles together while the agent is built around their setup.
Is this legal advice?
No. EraseCycle is software that runs the DROP process. Decisions about exemptions and your legal obligations stay with you and your counsel.
Does our consumer data or API key ever leave our servers?
No. The agent runs inside your infrastructure and your DROP API key stays there. We don’t receive consumer data. Support works from logs with consumer data removed.
Do you need access to our DROP account?
No. The account stays in your company’s own name, as the rules require. CalPrivacy lets brokers authorize agents to use their account, but our default setup doesn’t need it.
We only have CSV files and a small database. Is that enough?
Yes. Small setups are exactly who this is for. We’re starting with CSV files, Postgres, BigQuery and Snowflake.
Who decides when a request is exempt?
You do. EraseCycle flags possible exemptions for review and records your decision, so the reasoning is on file for the audit.
What happens if a cycle fails?
You get an alert. If your automated connection to DROP fails, the rules say you must tell CalPrivacy in writing, through your DROP account, within 45 days. The alert is there so that never catches you out.
Couldn’t we just write a hashing script?
Hashing is one step of seven. You’d still need to match across every system, delete inferences too, opt out shared identifiers, notify service providers, report every status within 45 days, keep a suppression list, and keep evidence for the audit.
If you want to test the hashing part yourself, our hash checker is free and passes all 23 of CalPrivacy’s published examples.
Can we test against the DROP sandbox?
Yes, from your own DROP account. CalPrivacy only opens the sandbox to registered brokers, so pilots test in their own sandbox before going live.
Find your DROP gaps before the 30-day cycle starts.
Ten questions based on CalPrivacy’s published guidance. Scored in your browser, with a recommendation for every gap. Your answers never leave the page.