WRITE ONCE LABS
Independent research
Updated 3 September 2026
Asking all 603 registered brokers

What are you doing about the 45-day cycle today?

I'm asking every broker on the register the same question. You'll get what comes back. There's nothing to buy today.

What missing a cycle costs you
$200
the state can charge you,
per request, per day
Joe Gilmour

I run Write Once Labs. Deletion duties became enforceable on 1 August 2026, the big brokers bought a platform, and nobody knows what everyone else did.

Your answer

A spreadsheet, a developer, a vendor, or nothing yet. Whatever is true.

Are you a registered data broker?

I'll send you the findings. Email me and I'll delete your address.

603
brokers on the California register, each on their own clock
45
days between mandatory cycles, restarting each time
30%
had processed a request one week after the deadline
2028
an independent auditor reads the record from 1 January
Why I'm asking

The duty repeats. That's the part that costs money.

Every registered broker now pulls the state's DROP list, matches it, deletes what matches, and reports back, on a 45-day clock that restarts each time. Doing it once is a task. Doing it every 45 days, on the record, for years, is a system.

If you don't have one, the cost isn't a fine you argue about later. It accrues daily, per request, while the request sits.

One cycle, then it starts again
  1. Day 0Pull the DROP list
  2. Step 2Match your records
  3. Step 3Delete what matches
  4. Step 4Report it back
  5. Day 45 = Day 0Clock restarts
no gaps, in order, back to August 2026 Cal. Civ. Code § 1798.99.86
The two parts people miss
01

You also can't buy them back

Once someone is deleted, you can't sell or share new information about them either. So every list you buy from here on has to be checked against every deletion you've already made.

Cal. Civ. Code § 1798.99.86(d)(2)
02

An auditor reads the record in 2028

From 1 January 2028, and every three years after, an independent auditor has to check that you processed deletions properly. You hand the report to the state within five business days of being asked, and keep it for six years.

Cal. Civ. Code § 1798.99.86(e)

So what the auditor wants isn't one clean cycle. It's every cycle, in order, going back to 2026.

Where the numbers come from

Every number here comes from the state's own published material. The sources are named below for your reference.

California Privacy Protection Agency data broker registry 603 · counted 3 Sep 2026
DROP Technical and API Reference v1.0.0 45-day cycle
Delete Act statute text § 1798.99.86
IAPP 30% in week one
Answer the question, get the findings
One line is enough. No newsletter.