California DROP with Transcend
California's Delete Act requires registered data brokers to process consumer deletion requests through DROP (Delete Request and Opt-out Platform), run by CalPrivacy. This overview explains how Transcend fits into that loop, what you still own, and what Phase 1 covers. It is not a setup walkthrough.
This is not legal advice. For the rules, see CalPrivacy's DROP materials and Transcend's DROP compliance guide. For configuration and a full cycle, see Set up and run California DROP.
Consumers register once with the state. DROP sends brokers hashed identifier lists (not plaintext emails or phones). You match those hashes to people in your systems, delete them (or opt out where required), and report a status for every row.
You do the matching. Transcend pulls the hashed list from DROP, turns your matches into erasure DSRs, runs them through your integrations, and builds the CalPrivacy report-back file. You still upload that file to the CalPrivacy portal in Phase 1.
Brokers must begin processing by August 1, 2026, in 45-day cycles. The 45-day clock starts when the list is downloaded, not when CalPrivacy first published it. See Processing DROP requests.
| Step | Who | What happens |
|---|---|---|
| Get the hashed list (File 1) | Transcend | Pulls File 1 from DROP with your broker API key. |
| Match | You | Hash your own records per CalPrivacy rules and produce File 2 (matched records). |
| Create and run erasures | Transcend | Turns File 2 into DSRs and runs your selected erasure workflow. |
| Report back | Both | Transcend builds the Id,Status CSV; you upload it to CalPrivacy. |
Transcend does not reverse hashes or invent matches.
Phase 1 is the operator-led Admin Dashboard loop: configure broker credentials and an erasure workflow, poll DROP for File 1, upload File 2, run erasures, generate the report-back CSV, and submit it in the CalPrivacy portal.
Your account team enables DROP and helps you complete a sandbox cycle before production.
- Automated File 2 upload via API for high-volume pipelines
- Scheduled, hands-off polling
- Transcend submitting the report-back to DROP for you
- CLI / pipeline-first flows
- Multi-million-row single-shot uploads
If Phase 1 fits your volume for August, you do not need later phases on day one.
DROP volume depends on how many Californians use DROP and which list types you subscribe to, not only on your customer count. Plan for growth each cycle.
Phase 1 expects an operator to upload File 2 in the browser (comfortable under roughly 100 MB). Prefer one open run at a time per broker organization.
If a list type regularly has hundreds of thousands of matches, split File 2 uploads and talk to your Transcend contact. Higher-volume API paths are on the roadmap.
How many DSRs? File 1 rows are hashed identifiers, not people. Use the same person_key across a person's email / phone / MAID matches so Transcend opens one DSR. Unmatched File 1 rows still need a report-back status (usually "not found") but do not create DSRs.
File 1 only has Id and Hash. You standardize identifiers the way CalPrivacy specifies, SHA-256 hash them, Base64-encode the digest, and compare. For every hit, File 2 carries the DROP Id, list type, and the identifiers Transcend should use. If your hashes disagree with CalPrivacy's, you under-match and over-report "not found." Transcend ships test vectors so your engineers can prove agreement before go-live. Transcend does not reverse hashes.
Report-back is an Id,Status CSV. Every File 1 id gets one status: exempt (2), deleted (3), opted out (4), or not found (5). Exact codes and edge cases are in the setup and run guide.
Do we still need the CalPrivacy portal?
Yes in Phase 1. You need CalPrivacy for registration, keys, and uploading the report-back.
Do we publish a DROP workflow to the Privacy Center?
No. Use an Internal erasure workflow selected in DROP Configuration. Keep Show in Privacy Center off unless you want that erasure action on your Privacy Center for other reasons.
Do we report before pulling the next list?
Yes: finish and submit the prior report-back before you pull the next list. Cadence is "report, then pull."
- Confirm you are (or will be) a registered California data broker.
- Share list types and rough volume per 45-day cycle with your Transcend contact.
- Follow Set up and run California DROP for configuration and a sandbox end-to-end run.