Managing Delete Request and Opt-Out Platform (DROP) Requests

Important:

The DROP support feature is under Public Preview. Please contact OneTrust Support to request early access.

The Delete Request and Opt-out Platform (DROP) allows California residents to submit a single request that requires all data brokers registered in California to take action on a users' data.

The action is either delete or opt-out depending on the completeness of the match between the data subject and the data brokers' system.

When a data subject submits a DROP request that matches with records on a data broker's system, all personal information on the data subject must be deleted, not just the information provided through DROP. The exception to this is data given directly to a business (known as first-party data), exempted data, and any publicly available data.

Data brokers must process consumer DROP requests every 45 days. Fines can total $200 per customer per day.

How OneTrust Integrates with DROP

This workflow describes how requests will be pulled from DROP into OneTrust via API, validated against existing data subjects, and either converted into DSAR requests for normal processing or marked as not found, with final request outcomes mapped and sent back to DROP.



To process DROP requests, data brokers must hash their data in a format that matches the hashed identifiers provided by DROP. All DROP request data is normalized and converted into one-way hashed values using a defined process, including SHA-256 hashing and Base64 encoding, and matching is performed against these hashed values.

This requires that the data broker’s systems maintain hashed versions of their data or hashed indexes that follow the same format, so that DROP request data can be compared against existing records to determine whether a match exists.

If a match is identified, a DSR request should be triggered and proceed to fulfillment. If no match is found, it will be treated as a record not found outcome.

DSAR request status

DROP request status

Completed (request type: deletion)

Deleted

Completed (request type: opt out)

Opted out

Closed

Exempted

Rejected

Record not found

Create a Workflow Integration to Support DROP Requests

Before you can sync requests from DROP you must create an integration workflow that validates DROP identifiers and routes matched requests to opt-out or data-deletion DSR workflows. For more information, see Creating a Workflow for Managing DROP Requests.

Sync Requests from DROP

Once you have created to workflow integration, you have two options for managing DROP requests: direct intake via an API, or manual bulk CSV upload.

Important:

It's strongly recommended that you test both intake methods in your sandbox environment before you start pulling live data from DROP into your production environment.

To Sync Requests from DROP Automatically via API

You can sync requests from DROP to your production environment.

  1. On the Privacy Rights Automation menu, go to Settings, then DROP integration. The DROP integration screen appears.


  2. Select Production to work with live data in your production environment.
  3. Enter your API key.
  4. Select the sync frequency in days. The determines how often the API will pull data from DROP.
  5. Select the integration workflow you created earlier from the drop-down list. For more information, see Creating a Workflow for Managing DROP Requests.
  6. Click the Save button. A DROP request ID will then be created for each request and will appear on the DROP requests screen with a Pending status. You may need to refresh the DROP requests screen to see the latest requests.
  7. The workflow integration you set up earlier will then be triggered, and will search your database for any matches. If a match is identified, a DSR request should be triggered and proceed to fulfillment. If no match is found, it will be treated as a record not found outcome.
  8. Results will display on the DROP requests screen, with a status of Deleted, Exempted, Not found, or Opted Out.
  9. The status of your DROP requests will be automatically sent back to DROP via API. For more information, see: Processing DROP requests.
Important:

You must repeat this process at least once every 45 days. The 45-day cycle starts as soon as data is pulled from DROP into your environment.

To Sync Requests from DROP Manually via a CSV file

  1. Download the .zip file which contains the CSV file with the latest DROP requests directly from DROP. For more information, see Processing DROP requests on the State of California website.
  2. On the Privacy Rights Automation menu, select Requests. The Requests screen appears.

  3. Click the Context menu next to the Create request button, and select View DROP requests.


  4. On the DROP requests screen, click the Upload requests button. The Upload DROP requests modal appears.


  5. Select Production to work with live data in your production environment.
  6. Upload the .zip file which contains the CSV file with the latest DROP requests.
  7. Select the integration workflow you created earlier from the drop-down list. For more information, see Creating a Workflow for Managing DROP Requests.
  8. Click the Upload button. A DROP request ID will then be created for each request and will appear on the DROP requests screen with a Pending status. You may need to refresh the DROP requests screen to see the latest requests.
  9. The workflow integration you set up earlier will then be triggered, and will search your database for any matches. If a match is identified, a DSR request should be triggered and proceed to fulfillment. If no match is found, it will be treated as a record not found outcome.
  10. Results will display on the DROP requests screen with a status of Deleted, Exempted, Not found, or Opted Out.
  11. You will then need to manually return the results to DROP. On the DROP requests screen, select the Download icon. The Export DROP requests modal appears.

  12. Complete the fields, and click the Export button. You will receive a notification in the Alert Center when your export file is ready to download.
  13. Report the status of your DROP requests back to DROP. For more information, see: Processing DROP requests.
Important:

You must repeat this process at least once every 45 days. The 45-day cycle starts as soon as data is pulled from DROP into your environment.

To Filter DROP Requests by Status

  1. On the Privacy Rights Automation menu, select Requests. The Requests screen appears.

  2. Click the Context menu next to the Create request button, and select View DROP requests.


  3. The Drop requests screen appears.

  4. Click the Add filter button. The Advanced filter modal appears.


  5. Select the criteria you want to filter by. The results will automatically display as you select your filter options.
  6. To clear your filter, click either the X next to the filter criteria or Clear all.