EraseCycle
Readiness check
Menu

Free self-assessment · 10 questions

How ready is your DROP deletion process?

Ten checks taken from CalPrivacy’s published guidance and the DROP API spec. Answer honestly: every “No” or “Not sure” is a gap that can turn into unprocessed requests. You’ll get a score and a specific fix for each gap.

Your answers never leave this browser. Scoring happens on this page. Nothing is stored or sent, and closing the tab clears everything. The optional email button only opens a draft in your own email app.

Are you registered for 2027, with the fee paid by 31 January 2027, and is your DROP account set up in your company’s own name?

Why it matters: Unregistered brokers are the main enforcement target. Announced settlements so far range from $34,400 to $110,490.

Are you downloading DROP lists at least every 45 days now, and ready for every 30 days from 1 January 2027?

Why it matters: The cycle shortens on 1 January 2027 (AB 883).

Have you selected every list type that matches data you hold (Email, Phone, MAID, NDZ = name + date of birth + ZIP, NameVIN, CTVID)?

Why it matters: Skipping a list you hold data for means requests go unprocessed.

Do you standardize records exactly to the spec before hashing? For example: email with whitespace removed and lowercased, phone as the last 10 digits, ZIP as the first 5, names folded to ASCII letters and digits.

Why it matters: One formatting slip means silent non-matches, so requests look processed but the data isn’t deleted.

Do you hash with SHA-256 → Base64, including the composite rule for NDZ and NameVIN (each field hashed, then joined and hashed again)?

Why it matters: Hex instead of Base64, or a missed composite step, makes matching fail quietly.

Do you check every system that holds consumer data (warehouse, CRM, files, ad platforms, partner feeds), and delete inferences too?

Why it matters: Deletion covers all non-exempt personal information, including inferences.

When one identifier links to several people, do you opt them all out of sale and sharing instead of deleting?

Why it matters: The rules require a different action for multiple matches.

Do you tell your service providers and contractors to delete or opt out, and keep proof that you did?

Why it matters: This is a required step, and auditors will ask for proof.

Do you report a status for every request within 45 days (Exempted, Deleted, Opted out, Not found), and correct mistakes through the amend endpoint?

Why it matters: Missing statuses look like unprocessed requests, at $200 per request per day.

Do you keep a suppression list, screen new data against it before every sale or share, and log each cycle for the independent audits starting 1 January 2028?

Why it matters: Deleted people can re-enter through new data, and audits will need evidence.

If your automated connection to DROP fails, do you know you must tell CalPrivacy in writing within 45 days?

Why it matters: Not scored, but it’s a rule that catches brokers out.

About your setup · optional

Only used if you choose to email your results, so the founder can come prepared.

Where does your consumer data live?
Who handles DROP today?