Drop45 standardizes, hashes, and matches CalPrivacy DROP deletion lists against your records — entirely in your browser. Consumer data never leaves your machine. Built to the official CalPrivacy technical spec.
Run a match now — free See ProFrom Aug 1, 2026, every registered California data broker must pull DROP deletion requests at least every 45 days, match them against records, delete or opt out, and report a status for every request.
SB 361 sets fines at $200/day per unprocessed deletion request, plus CalPrivacy's investigation costs. One hundred missed requests is $20,000 a day.
Enterprise privacy platforms handle DROP for $499+/mo. Small brokers — lead-gen firms, people-search sites, list managers — need the matching done, not a platform. That's Drop45.
Everything below runs locally in your browser (SHA-256 via WebCrypto). Your files are never uploaded. Free tier matches up to 500 of your records per run — Pro is unlimited and adds status files, suppression lists, and audit evidence.
Unmatched requests are reported as status 5 (not found) automatically.
Matched work items:
Sanity-check the standardization: type any email and see the exact standardized value and SHA-256/Base64 hash Drop45 produces per the CalPrivacy spec.
Sign in to the DROP broker portal and download your deletion lists (CSV per list type). Required at least every 45 days from Aug 1, 2026.
Drop45 standardizes your records exactly per the CalPrivacy spec (casing, accents, E.164-style phones, ZIP rules), hashes with SHA-256/Base64, and matches against the list — including composite NDZ and Name+VIN hashing.
Export the delete worklist for your database team, the Id,Status response file to upload back to DROP, a suppression list for ongoing screening, and a timestamped audit evidence report.
Try the full pipeline
Everything a small broker needs, every 45-day cycle
What DROP compliance platforms charge small brokers today
If you're a large broker with service-provider orchestration needs, an enterprise platform is the right call. If you need the 45-day cycle handled correctly, Drop45 does it.
No. Parsing, standardization, hashing, and matching run in your browser via the WebCrypto API. The only network call Drop45 ever makes is license verification (the key string only).
No — you download your deletion lists from the DROP broker portal (manual download is fully supported by CalPrivacy) and drop the CSV here. API-based auto-pull is on the roadmap for Pro.
All six DROP list types: Email, Phone, Mobile Ad ID, Connected TV ID, Name+DOB+ZIP (NDZ), and Name+VIN — including the composite hash-of-hashes construction for NDZ and Name+VIN.
Drop45 automates the matching and reporting mechanics. Actually deleting matched records from your systems (and directing your service providers to delete) is your obligation. Drop45 is software, not legal advice — consult counsel on exemptions.
Drop45 is an independent tool by a solo developer, part of a portfolio of small privacy and compliance tools. Questions? Use the contact page — we reply by email.