Since August 1, 2026, every data broker on the CPPA registry owes the state a deletion cycle every 45 days: pull the DROP list, match it, delete what matches, report back.[CPPA regulations] Forever, on a clock that doesn't pause. DROP Ops runs that clock for you and keeps the receipts.
38 daysuntil the current DROP access window closes (September 15, 2026)
Demo account shown; fictional data.
The stakes are statutory: non-compliance accrues at $200 per unprocessed deletion request per day[Civ. Code §1798.99.85(d)] under the DELETE Act, and the CPPA's Data Broker Enforcement Strike Force[CPPA, Nov 2025] is actively auditing the registry. A missed window doesn't stay small.
What does a missed window actually cost?
The statute fines $200 per deletion request per day — for requests a broker fails to delete as required. Process the full list correctly and report on time, and you owe nothing, however large the list.[Civ. Code §1798.99.85(d)]
Statutory exposure
$1,400,000
500 failed requests × 14 days × $200 — versus $249/month for the cycle to simply run on time.
How it works
Install the agent
One self-contained binary, running where your data already lives. Your DROP API key and consumer records stay on your infrastructure because nothing else ever sees them.
It runs the 45-day cycle
The agent pulls the state's deletion list, hash-matches it against your records to the letter of the CalPrivacy spec, writes your deletion worklist, and files status codes back to DROP.
You keep the proof
Every step lands in a hash-chained evidence log on your machine. One command bundles it into a pack you can hand an auditor.
One cycle, and where your data is at every step
Scroll through it. The dashed line is your infrastructure boundary — watch what crosses it, and what never does.
The state's list arrives
Every 45 days the agent pulls CalPrivacy's encrypted deletion list into your environment.
Matching runs inside your boundary
Hash-matching happens on your machines, against your records. Nothing is uploaded anywhere.
Only status codes leave
The agent files per-request status codes back to DROP. Codes — not records, not hashes.
The evidence chain seals
Each step is appended to a SHA-256 hash chain on your machine. Verifiable by anyone; alterable by no one, silently.
Built to the letter of the spec
Validated against the state's own test vectors
The hashing engine passes every test vector CalPrivacy publishes — the exact cases the state uses to define what a correct match is.[CalPrivacy: working with data]
Built to DROP Technical Documentation v1.1.0
File formats, field standardization, composite hashes, status codes, API behavior: implemented from the state's published spec, and the full client–server exchange is contract-tested against the state's published OpenAPI document. (Live-API access requires broker credentials; we have not yet exercised the live endpoints.)[CalPrivacy: API operations]
Evidence anyone can verify
The log is a SHA-256 hash chain. Run dropagent verify and the whole history checks itself — you, your lawyer, or an auditor, no trust in us required.
One dependency-free binary
A single Go binary. Zero external packages. No runtime to install and nothing phoning home except a counts-only heartbeat you can read in the source.
Self-hosted by design — not as a feature, as the architecture
Your DROP API key, your consumer records, and the state's deletion lists are processed entirely on your machines. What does our dashboard get? Operational counts and cycle status. Never identifiers, never hashes. If our servers vanished mid-cycle, your compliance run would finish without noticing.
Pricing
Self-serve
$249/month
- The dropagent binary for macOS, Linux, and Windows
- Deadline tracking and agent health dashboard
- Tamper-evident evidence log + local audit packs
- Email support
Assisted
$497/month
- Everything in Self-serve
- Onboarding call: we map your record fields together
- We watch your cycle status and contact you before a missed deadline
- Priority support (same business day)
Cancel anytime. If a subscription lapses, your license stops verifying — but running compliance cycles are never blocked. We don't hold your legal obligations hostage.
Who's behind this
DROP Ops is built by James Craig, its founder, and operated from Canada. It exists because the DELETE Act handed five hundred–odd registered brokers a permanent 45-day obligation, and the tools on offer were either five-figure enterprise suites or spreadsheets and hope. Most brokers are small companies; they deserve compliance software sized and priced for them, built by someone who read the spec.
Every plan includes email support: support@dropopscompliance.com, answered within 2 business days.
Questions a careful buyer asks
What can DROP Ops see about my business?
Counts and status. A heartbeat carries the agent version, cycle status, a timestamp, and five integers — the API rejects anything more. Consumer identifiers, hashes, your records, your DROP API key: none of it ever reaches us. Full architecture.
What happens if your dashboard goes down?
Nothing happens to you. License checks are advisory on purpose — the agent caches the last answer and runs regardless. We decided early that our uptime must never gate your legal compliance, and we built the agent so it can't.
Do I have to change my database?
No. The agent reads a CSV export of your consumer records; your systems stay untouched. Direct database connectors are on the roadmap.
How is this different from an enterprise privacy platform?
Those are five-figure suites that do a hundred things for a privacy team. This does one legally mandated job — the 45-day DROP cycle — with proof, at a price you can approve without convening anyone.
What about the 2028 triennial audit?
You'll already have the evidence. Every cycle sits in your hash-chained log, and dropagent evidence-pack bundles the chain, your status filings, and a verification report into a tarball built on your machine. Hand it over directly.
What if I cancel?
Your agent keeps running. A lapsed subscription ends dashboard access and license verification — never a compliance cycle. Billing problems should cost us revenue, not you a penalty.