DropDue · California DROP compliance
Prove you deleted it. Not just tried.
DropDue runs your California DROP cycle every 45 days. Automated: runs itself, one-click approval. Self-serve: you run it yourself.
No demo, no sales call.
- Statutory penalty
- up to $200/day
- Deletion cycle
- every 45 days
- California registration
- $6,000 · Jan 31
Your cycle, mid-flight.Every step timestamped and hash-chained.
CPPA enforcement actions
Real fines. Companies your size.
The CPPA is fining small brokers, not just enterprise ones.
- $35,400
- Growbots, Inc.Failed to register as a data broker.
- $34,400
- UpLead LLCRegistered late, then stayed late.
- $116,490
- LocateSmarter LLCThe largest broker penalty so far.
source: cppa.ca.gov, published enforcement orders
See what your own dates add up to ↓Exposure calculator
Here’s your number.
Move the sliders. This is the statute’s own math: $200 per request, per day.
Late registration: your statutory exposure
$35,400
177 days × $200
Plus 250 unprocessed deletion requests.
Each one carries its own $200-a-day clock, counted separately.
Statutory maximums under Cal. Civ. Code § 1798.99.82. Not predictions, and not legal advice. DropDue keeps the record. Your counsel makes the judgment calls.
Automated is $4.90 a day. The fine is up to $200 a day.
See pricingOne cycle, every 45 days.
You download the list every 45 days, we match it, you approve, the status file is filed.
45 DAYS · THEN AGAIN
- 01
- 02
- 03
- 04
The part that quietly breaks.
A hash is a scrambled identifier. Get the field order wrong and every match fails silently. The deletion never happens, and the clock keeps running.
Check a hash (free)We keep what the state doesn’t.
Every cycle, match, and filed status: logged, chained, exportable as PDF or JSON. Hashing runs in your browser; raw data never reaches our servers.
See a sample proof pack →- Tamper-evident log
- Each entry is locked to the one before it.
- Export anytime
- PDF or JSON, on your own machine.
- We never see raw data
- Only hashes and cycle records leave your browser.
How we hold your key.
The DROP key is the most sensitive thing you hand us. Here is exactly what happens to it.
No SOC 2 report yet. It is on the roadmap, and we will say so here the day that changes.
Read the security page →- AT REST
- Encrypted at rest with AES-256. Never written to a log.
- WHO SEES IT
- Nobody at DropDue. It is decrypted only inside the job that calls DROP, never shown back to you or to us.
- WHEN YOU LEAVE
- Delete it, or cancel, and it is purged immediately. Automated pulls stop the same minute.
- ON PAPER
- A DPA carrying California's service-provider terms is presented at signup. Not on request.
Two dates, all year.
We track both, alert you early, and fill in your registration answers. You still click submit.
- REGISTRATION · ANNUAL
- California$6,000due Jan 31 · + processingFILED · 2026-01-14
- DELETION CYCLE · DROP
- 45 dayseach cyclenext download due Apr 2ON TRACK · DAY 31
Fee per the CPPA data broker registration page, Aug 2026.
Alerts before the deadline. Automated, $149/mo →Two ways to run it.
- SELF-SERVE
- you upload the status file to DROP yourself.
- AUTOMATED
- scheduled pull, match and submit, plus alerts.
Self-serve
$49/mo
Cycle tracker, CSV matcher, audit log. No alerts. You run each cycle yourself.
Start Self-serve →Automated
$149/mo
Scheduled DROP pull, match and report. Every cycle, without you starting it.
- Alerts before the deadline, not after
- Audit log you can export and hand over
No demo. No sales call.
Done for you
$490/mo
Our team runs and confirms each cycle for you, logged the same way. You get the report.
Talk to us →If we drop the ball, we pay for it.
Miss a cycle you set up correctly, and that month is refunded.
Correctly set up = valid key, accurate settings, your confirmations made in time.
The refund is the remedy. Statutory penalties stay with you, the broker of record. Full guarantee terms →
No contract · cancel any cycle
The ones you’d ask.
Rather not touch any of it? Done for you is $490/mo. Our team runs and confirms every cycle. You get the report.
See pricing →- No. Hashing runs in your browser. We store hashes and cycle records, not raw data.
- Check it yourself, free, before paying us anything. We test against CalPrivacy’s own published vectors.
- You issue it yourself in the CPPA Data Broker Portal: Consumer Deletion Lists, then the API Key tab. You only give it to us on Automated and Done for you. Self-serve never asks for it.
- Submitted means your status file reached DROP and was accepted for validation. Filed means the CPPA confirmed it back, usually within a week. We show both, because only one of them is proof.
- You do. DropDue shows you every match and files exactly the status you pick, with your reason and your name against it. We do not make that call for you.
- Every export is a file you already own. Your compliance record doesn’t depend on us staying open.
Your next cycle opens whether you’re ready or not.
Start with the free hash checker. It takes about a minute.