1
Secure matching
Provide Optacy with an export of your hashed customer identifiers, for example to an S3 bucket or database.
Data Brokers
The California DROP Act
Complying with the DROP Act (SB 362) is simple with Optacy
As a registered data broker, you must retrieve consumer deletion requests from California’s Delete Request and Opt-Out Platform (DROP) every 45 days. Optacy connects to your DROP account via API, downloads the latest hashed identifiers (SHA-256), matches them to your data, and creates delete/opt-out requests so you can fulfill and prove compliance.
How Optacy connects to your DROP account
Automate matching, deletion, and suppression while keeping customer PII out of the comparison.
2
Zero-knowledge comparison
We match the state’s request list against your hashes. We never need to see your customers’ plain-text names or emails.
3
Automated deletion
For every match, Optacy triggers a privacy request in your account. Integrations then anonymize or delete data across connected services using the hashed ID as the primary key.
4
Permanent suppression
All IDs are added to an aggregated suppression list so newly acquired data cannot re-enter your system. This is a mandatory DROP Act requirement. Publish that list back to S3, a database, or another export method you choose.
- Optional: if you need an API to check the suppression list, we offer that as well.
- Need a second point of contact before deleting? Ask about additional verification methods for your systems.
Proving compliance
We close the loop by reporting fulfillment status for each request back to the CPPA. Optacy also simplifies your mandatory July 1 annual disclosure. Your dashboard generates the metrics to display on your website.
Total requests to delete, know, opt-out, correct, and limit
Requests fulfilled vs. denied
Mean and median response times by request type
If you already use our webform, every direct deletion request syncs to your DROP suppression list, keeping your privacy stack unified and audit-ready.
Connecting Optacy and DROP
Integrating with California’s portal doesn’t require a heavy engineering lift. Onboard in two simple phases.
Phase 1: Zero-risk testing in the CPPA sandbox
Validate database matching and automated deletion before anything goes live.
- Log into your CPPA Developer Portal and open the credentials tab.
- Generate an API key for the DROP sandbox environment.
- Reach out to support to enable integrations in your Optacy account.
- Paste that key into your Optacy dashboard under Integrations.
Phase 2: Flip the switch to live compliance
Once workflows look good, move to production in seconds.
- Generate your production DROP API key from your registered CPPA broker account.
- Swap the sandbox key in Optacy for your production key.
Every 45 days, Optacy talks to the state, ingests the newest consumer hashes, sweeps your data architecture, logs fulfillment metrics for your compliance widget, and reports success tokens back to the CPPA API.
Ready for high-volume DROP compliance?
If you are a data broker that needs a solution for high request volume, we offer competitive pricing and an extensive integration platform. We look forward to helping with your DROP requirements.
Join the Optacy community today
Have any questions? Call us.
From the US: +1 (855) 5-OPTACY (855-567-8229)
From outside the US: +1 (302) 864-2253