GLOSSARY

California data broker glossary

The words the statute, the state portal and this product use, defined once.

Compliance vocabulary drifts, and two people using the same word for different things is how a cycle gets filed wrong. These are the definitions this site uses everywhere, with the statute cited where one exists.

45 day cycle: The 45 day cycle is the maximum interval California allows between the times a registered data broker processes the DROP deletion list, from download through match to submitted status.
Audit trail: An audit trail is the dated, tamper evident record of everything a broker did in a deletion cycle, from the list version pulled to the person who confirmed each determination and the status file that was submitted.
Broker ID: A broker ID is the four digit number DROP assigns to a registered data broker, identifying that broker's account, its downloads, and the status files it uploads.
CCPA service provider: A CCPA service provider is a business that processes personal information on behalf of another business for a specified purpose, under a written contract that limits what it may do with that information.
CPPA: The California Privacy Protection Agency is the state body that administers the data broker registry, runs the DROP platform, and enforces the registration and deletion duties the Delete Act created.
Data broker: A data broker is a business that knowingly collects and sells personal information about consumers it has no direct relationship with, and that must register with the California Privacy Protection Agency every year.
Delete Act (SB 362): The Delete Act is the 2023 California law, Senate Bill 362, that moved the data broker registry to the California Privacy Protection Agency and created a single state platform through which a consumer can ask every registered broker to delete their personal information at once.
Deleted vs exempted: Deleted and exempted are the two DROP status codes a broker decides for itself, code 3 for information it removed and code 2 for information it is keeping on a legal basis.
Deletion request: A deletion request is a verified consumer submission through DROP asking every registered California data broker to delete the personal information it holds about that consumer.
DROP: DROP is the Delete Request and Opt-out Platform, the California Privacy Protection Agency system that takes deletion requests from consumers and publishes them to registered data brokers as lists of hashed identifiers.
Exemption: An exemption is a broker's determination that a record matched by a deletion request will be retained rather than deleted because a law permits or requires keeping it, reported back to DROP as status code 2.
Hashing: Hashing is the one way transformation, SHA-256 encoded as Base64 in DROP's case, that turns a standardized identifier into a fixed string so brokers can match consumer deletion requests without exchanging the identifiers themselves.
Registration fee: The registration fee is the $6,000 a data broker pays California each year, alongside the annual registration due by January 31, to appear on the state data broker registry.
Statutory penalty: The statutory penalty for a data broker that fails to register in California is up to $200 per day for each day the registration is late, assessed by the California Privacy Protection Agency.
Submitted vs Filed: Submitted means your status file has been accepted by DROP for validation, and filed means DROP has confirmed the records inside it were valid, which is the only one of the two that closes a cycle.
Test vector: A test vector is a known input paired with its known correct hash, used to check that an implementation standardizes and hashes identifiers the way the DROP specification requires.