Set up and run California DROP
This guide walks through configuring DROP in Transcend and running one Phase 1 cycle: poll File 1 from CalPrivacy, upload your matches, run erasures, and generate the report-back file.
New to DROP? Start with California DROP with Transcend for concepts, scope, and volume planning. Data brokers must begin processing by August 1, 2026, on a 45-day cycle. This article is not legal advice.
You'll need:
- A CalPrivacy data broker account and CPPA-issued broker ID.
- DROP enabled on your Transcend organization. Contact your account team if you don't see DROP in the Admin Dashboard.
- A DROP API key from CalPrivacy. Required: Transcend pulls File 1 only through the DROP API. Start in sandbox.
- An Internal Workflows V2 erasure workflow (not published to the Privacy Center). See the Workflows quickstart if you need to create one.
- A way to match CalPrivacy's hashed identifiers against your records and produce File 2. Transcend does not match for you.
Open the DROP page in the Admin Dashboard and go to the Configuration tab. This is a one-time, per-organization setup.
| Field | What to enter |
|---|---|
| Data broker ID | Your CalPrivacy-issued identifier, e.g. DB-01234. Echoed into report-back filenames. |
| Environment | Sandbox while you test; Production for live cycles. |
| List types | The deletion-list types you process (email, phone, mobile ad ID, connected TV ID, or composite identity lists). |
| Workflow | Select the Internal erasure workflow DROP requests should run through. DROP will not create requests until a workflow is selected. |
| DROP API key | Your CalPrivacy DROP API key for the selected environment. |
Click Save.
- Click Poll DROP for requests to pull File 1 from CalPrivacy. Prefer one open run at a time: finish or park a run before polling again.
- Match the hashed identifiers against your records using CalPrivacy's standardization and hashing rules, then produce File 2.
- Upload File 2 on the run. Transcend groups matched rows by person and creates one erasure request per person, even if they matched on several identifiers.
- Wait for erasures to finish through your selected workflow and connected integrations.
- Open the run detail page and click Generate report. Transcend generates the CalPrivacy report-back file once every request in the run has reached a terminal state, or once the run has passed its 45-day deadline.
- Download the report-back CSV, upload it to the CalPrivacy Data Broker Portal, then mark the run submitted in Transcend.
CalPrivacy's lists contain one row per hashed identifier, so the same person can appear more than once (for example email and phone). Transcend groups File 2 rows by person before creating a request, so one person produces one erasure request that carries every DROP record ID it covers. Those IDs show on the request details page, in the requests table, and in CSV exports.
| Code | Status | Meaning |
|---|---|---|
2 | Exempt | Match found, but data is exempt from deletion. |
3 | Deleted | Match found and non-exempt personal information was deleted. |
4 | Opted out | Multiple consumers share the identifier; all were opted out of sale or sharing. |
5 | Not found | No match, or the request did not reach a terminal state before the deadline. |
Do I submit the report-back file myself?
Yes in Phase 1. Transcend generates the file; you download it and upload it to the CalPrivacy portal.
Will one person create multiple erasure requests?
No, if File 2 groups them as one person. Transcend creates one request that still carries every DROP record ID.
Does Transcend store matched records in plaintext?
Matched identifiers use the same encrypted request pipeline as other data subject requests.
What if requests are still open near the 45-day deadline?
Transcend blocks report generation while requests are pending, with an exception once the run passes its deadline, so you are never stuck unable to report.
Is sandbox different from production?
Same shapes; different environment and API key. Finish one full sandbox cycle before switching to production.
Concepts and planning: California DROP with Transcend.
Regulatory source of truth: CalPrivacy's DROP for data brokers.