# The 45 Day Clock: What Brokers Must Do After Your DROP Request

Source: https://delisthq.com/blog/2026-11-06-drop-45-day-clock-brokers/

DelistHQ blog · 2026-11-03


Published 2026-11-06

You filed a deletion request through California's DROP platform, and nothing happened. No confirmation, no deletion, no reply. That silence might be normal, or it might be a broker breaking the law, and the difference is a clock you cannot see. DROP, the Delete Request and Opt-out Platform, opened to California consumers on January 1, 2026. Brokers have to retrieve requests from it at least once every 45 days, and process each request within 45 days of receipt. The penalty for failing is 200 dollars per request, per day.

The Delete Act, SB 362, signed in October 2023, built the platform. One consumer request covers all 590-plus registered data brokers, and the consumer verifies residency through the California Identity Gateway or Login.gov, then gets an 8 digit DROP ID. The broker side of that transaction is where the clock runs, and it started on August 1, 2026.

## What the broker has to do, and when

Beginning August 1, 2026, every registered data broker must access DROP at least once every 45 days and process the deletion requests it finds there. Processing means deleting all nonexempt personal information, including inferences, for the consumer, and doing it within 45 days of receipt. The duty repeats: every 45 days, the broker pulls again, and must not sell or share new personal information about a requester in the meantime. The obligation is ongoing, not a one-time cleanup.

The registration side has its own dates. Brokers must register annually by January 31 and pay a 6,000 dollar fee plus a processing fee of up to 2.99 percent. Late registration costs 200 dollars per day after January 31. Brokers who began operating between January 1 and August 1, 2026 had to create a DROP account, pay the access fee, and start processing. Brokers who begin after August 1 must create an account before they commence operations.

## Why your request might sit unread

The most common reason is that the broker has not pulled DROP yet, and is still inside its 45 day window. A request filed on day one of a broker's cycle can sit for up to 45 days before anyone at the broker sees it, and then the broker has 45 days to process it. That is up to 90 days from filing to deletion, all of it legal. The platform shows the requester the status of their request, so check DROP before assuming the broker is ignoring you.

The second reason is scope. The Delete Act defines a data broker as a business that knowingly collects and sells the personal information of a consumer with whom it does not have a direct relationship, and the 2026 regulations expanded that definition. A company that believes it is not a broker may not have registered at all, and an unregistered company is not pulling DROP. That is a different problem, and it is the one the CPPA's Data Broker Enforcement Strike Force was created to pursue.

## What to do when the clock runs out

Track the dates. Note the day you filed, the DROP ID, and the 45 day mark for retrieval plus the 45 day mark for processing. If both pass with no action, the broker is in violation at 200 dollars per request per day, and the complaint goes to the California Privacy Protection Agency. Keep the DROP status page as your evidence: it shows the request, the date, and the lack of action in one place.

And do not expect the deletion to be permanent without follow-up. Brokers re-collect data from the same sources that fed them the first time, which is why the Act requires re-deletion every 45 days. A single DROP request is not a one-time erasure. It is an ongoing instruction, and the brokers that honor it are the ones that pull the platform on schedule.

Keep reading: [California DROP Lets Residents Delete From 600 Brokers at Once](https://delisthq.com/blog/2026-11-05-california-drop-deletion-platform/index.md), [Removing a Google Result Is Not Delisting. Do the Source First.](https://delisthq.com/blog/2026-11-05-delisting-vs-google-removal/index.md), and [The Verification Loop: Why People Search Sites Ask You to Prove You Are You, Then Lose the Proof](https://delisthq.com/blog/2026-11-04-people-search-optout-verification-loops/index.md) cover the nearby cases in this series.

## Frequently asked questions

### How long does a broker have to process my DROP request?

Brokers must retrieve requests from DROP at least once every 45 days and process each request within 45 days of receipt. From filing to deletion can take up to 90 days, all of it within the legal window.

### What is the penalty for a broker that ignores DROP?

Two hundred dollars per request, per day, for failure to process deletion requests, plus 200 dollars per day for failure to register. The CPPA enforces both.

### How do I check the status of my DROP request?

DROP shows the requester the status of their request. Log in with the same identity verification you used to file, and check the status page before assuming the broker is ignoring you.

### Does one DROP request cover all data brokers?

Yes. A single request goes to every registered data broker in California, more than 590 of them. You can exclude specific brokers if you choose, but the default is all of them.