# California Privacy Protection Agency (CalPrivacy)

> The California state regulator for the CCPA and the Delete Act. It operates DROP, the Delete Request and Opt-out Platform, and publishes the DROP Data Broker API — a three-operation REST surface data brokers must use to download hashed consumer deletion lists and report per-request status at least once every 45 days from August 1, 2026.

This file was generated by API Evangelist on 2026-09-17 from the agency's public pages and its published OpenAPI; CalPrivacy publishes no llms.txt of its own (privacy.ca.gov/llms.txt and cppa.ca.gov/llms.txt both 404). Links are public pages only.

## Core Pages

- [CPPA home](https://cppa.ca.gov/): Agency site — regulations, meetings, announcements, enforcement.
- [privacy.ca.gov](https://privacy.ca.gov/): Consumer and data broker site operated by the agency.
- [DROP for consumers](https://privacy.ca.gov/drop/): How Californians submit one deletion request to every data broker.
- [DROP for data brokers](https://privacy.ca.gov/drop-for-data-brokers/): Obligations, timeline, penalties and the data broker guide.
- [Data Broker Registry](https://cppa.ca.gov/data_broker_registry/): Searchable registry with CSV downloads (registry.csv, registry2024.csv, registry2025.csv, complete-reg-data-brokers.csv).
- [Data Broker Portal](https://databroker.drop.privacy.ca.gov/): Login-gated account, registration, fee payment, list selection and API key issuance.
- [Contact DROP support](https://databroker.drop.privacy.ca.gov/Contact): Support channel for account and integration questions.

## Developer Documentation

- [Technical specifications](https://privacy.ca.gov/drop-for-data-brokers/technical-specifications/): Documentation hub, version 1.2.0 (July 2026).
- [OpenAPI 3.1.0 (YAML)](https://dropresources.blob.core.windows.net/apidocs/databroker_api.yaml): Machine-readable contract for the DROP Data Broker API.
- [Getting started](https://privacy.ca.gov/drop-for-data-brokers/technical-specifications/getting-started/): Prerequisites, base URLs, X-API-KEY authentication, API key issuance, quick start.
- [Integration workflow](https://privacy.ca.gov/drop-for-data-brokers/technical-specifications/integration-workflow/): The download-process-upload cycle, status codes 2/3/4/5, validation.
- [Working with the data](https://privacy.ca.gov/drop-for-data-brokers/technical-specifications/working-with-data/): List types, CSV schemas, file naming, standardization and SHA-256/Base64 hashing rules with worked examples.
- [API operations](https://privacy.ca.gov/drop-for-data-brokers/technical-specifications/api-operations/): GET /data/download, POST /data/upload, POST /data/amend, response codes, error handling, retry table.
- [Reference](https://privacy.ca.gov/drop-for-data-brokers/technical-specifications/reference/): Glossary, status codes, webhook notifications and HMAC-SHA256 verification, version history, support.
- [Processing DROP requests](https://privacy.ca.gov/drop-for-data-brokers/process-drop-requests/): Legal cadence (every 45 days), sandbox, matching obligations.
- [Fees and registration](https://privacy.ca.gov/drop-for-data-brokers/account-creation-fees-and-annual-registration/): $6,000 annual registration fee, month-based access fee schedule.
- [DROP system requirements regulations](https://privacy.ca.gov/laws-and-regulations/drop-system-requirements/): Rulemaking record for Cal. Code Regs. tit. 11 § 7600 et seq.

## API Surface

- Base URL: https://api.drop.privacy.ca.gov (sandbox: https://api.drop.privacy.ca.gov/sandbox)
- Auth: X-API-KEY header, key scoped to the selected consumer deletion lists; issued only to registered, fee-paid data brokers.
- GET /data/download (downloadData): ZIP of hashed deletion-list CSVs; 202 + Retry-After while preparing; 409 if the prior batch is open.
- POST /data/upload (uploadData): multipart/form-data `files` of Id,Status CSVs; 202 with accepted[]/rejected[].
- POST /data/amend (uploadAmend): same format, corrects previously submitted statuses.
- Rate limiting: 429 with Retry-After (30 s guidance); no numeric limit published.
- Webhooks: optional download.ready, upload.received, upload.processed, amendment.received, amendment.processed, signed HMAC-SHA256 over "<timestamp>.<body>" in X-Webhook-Signature.

## Policies

- [Privacy policy](https://privacy.ca.gov/privacy-policy/)
- [State of California conditions of use](https://www.ca.gov/legal/conditions-of-use/)
- [CCPA regulations](https://cppa.ca.gov/regulations/)
- [Announcements](https://cppa.ca.gov/announcements/) and [Newsroom](https://privacy.ca.gov/about-us/newsroom/)

## API Evangelist Artifacts

- [apis.yml](https://raw.githubusercontent.com/api-evangelist/california-privacy-protection-agency/refs/heads/main/apis.yml): APIs.json index for this profile.
- openapi/california-privacy-protection-agency-drop-data-broker-api-openapi.yml: verbatim copy of the published OpenAPI.
- conventions/, errors/, authentication/, rate-limits/, sandbox/, asyncapi/ (webhooks), skills/: derived and searched profile artifacts.