Working with the data

Each download contains identifiers provided by consumers as part of their deletion requests via DROP. These identifiers are standardized, hashed and then provided as part of a consumer deletion list.

When you download data from DROP, you receive a ZIP file containing one CSV file for each selected consumer deletion list.

Every row in the CSV includes an ID column that identifies a single work item. The corresponding Hash column contains the hashed identifier you will compare against your own records.

When you upload via DROP, your response file must include that same work item identifier in the ID column alongside the status code you assign based on the outcome of your matching.

DROP delivers consumer deletion request data organized by list type. There are six list types, and each list includes one or more consumer identifiers. To generate your API key, you must select which list(s) you will process.

Your download in DROP will contain one CSV file per selected list. If a selected list has no identifiers available, the download will include an empty CSV file for that list with headers only.

After initial download and completed upload, future downloads will include only new identifiers since previous list download.

If any previously delivered identifiers have been removed, for example if a consumer cancels their deletion request, the download will also include a CSV file containing those removed identifiers across all selected lists. 

Data brokers must select every consumer deletion list containing a consumer identifier corresponding to personal information about that consumer within the data broker’s own records. However, a data broker may select fewer lists if the consumer identifiers used across multiple lists would lead to matches with the exact same set of consumers in the data broker’s records.

Data brokers are not required to respond with status for an empty file or for removed identifiers. 

• GET /data/download
• POST /data/-upload
• POST /data/-amend

For more information on the legal requirements based on match outcomes, see California Civil Code section 1798.99.80 et seq. and CCR, title 11, section 7600 et seq.

DROP provides consumer identifiers in hashed form. To match DROP identifiers against your own records, you must standardize and hash the identifiers in your records using the same rules.

General rules

• Apply the identifier-specific standardization described below.
• Hash with SHA-256 using UTF-8 input encoding.
• Output as Base64.

Tip: A SHA-256 Base64 hash is typically 44 characters and commonly ends with ID=.

Name standardization

Names are stored as separate First Name and Last Name values.

• Use lowercase values 
• Replace accented Latin characters with plain ASCII equivalents when possible. 
• Replace supported special Latin characters with common plain ASCII equivalents, such as ß → ss, æ → ae, œ → oe, ø → o, and ł → l. 
• Transliterate Greek and Cyrillic characters to Latin equivalents using a common transliteration library or method. For closest alignment with DROP, use or compare against the DROP Transliteration Mapping. 
• Leave Chinese, Japanese, Korean, Arabic, and Hebrew characters unchanged    
• Treat compound first names as a single unit (e.g., “Juan Pablo” → juanpablo) 
• Remove hyphens, apostrophes, spaces, punctuation, symbols, and other non-letter/non-digit characters 

DROP Transliteration Mapping:

Greek: α → a, β → v, γ → g, δ → d, ε → e, ζ → z, η → i, θ → th, ι → i, κ → k, λ → l, μ → m, ν → n, ξ → x, ο → o, π → p, ρ → r, σ → s, ς → s, τ → t, υ → y, φ → f, χ → ch, ψ → ps, ω → o, ά → a, έ → e, ί → i, ή → i, ύ → y, ό → o, ώ → o, ϊ → i, ΐ → i, ϋ → y, ΰ → y 

Cyrillic: а → a, б → b, в → v, г → g, д → d, е → e, ё → yo, ж → zh, з → z, и → i, й → y, к → k, л → l, м → m, н → n, о → o, п → p, р → r, с → s, т → t, у → u, ф → f, х → kh, ц → ts, ч → ch, ш → sh, щ → shch, ъ → [removed], ы → y, ь → [removed], э → e, ю → yu, я → ya, є → e, і → i, ї → i, ґ → g, ў → u 

 Special Latin: ß → ss, æ → ae, œ → oe, ø → o, ð → d, þ → th, ł → l, đ → d, ħ → h, ŋ → n, ı → i, ij → ij, ŀ → l 

Hashing example:

Date of birth standardization

Convert to YYYYMMDD format. Use a four-digit year.

ZIP code standardization

Keep alphanumeric characters only, convert to lowercase, remove leading zeros, and use the first five characters.

Email standardization

Remove whitespace and convert to lowercase. Do not remove dots, plus signs, or other characters.

Phone standardization

Strip all non-numeric characters. Use the last 10 digits, or all digits if fewer than 10 are present.

VIN standardization

Keep only alphanumeric characters and convert to lowercase.

MAID standardization

Keep only hexadecimal characters ( 0–9 , a–f ) and convert to lowercase. The standardized value must be 32 characters. 

CTVID standardization

Keep only alphanumeric characters and convert to lowercase. The standardized value must be between 8 and 32 characters.

The NDZ and NameVIN list types use composite hashing. This means each field is standardized and hashed first, then the resulting Base64 hashes are concatenated and hashed again.

NDZ: Name + Date of Birth + ZIP

1. Standardize and hash each field separately (SHA-256, UTF-8, Base64).
2. Concatenate the four Base64 hashes in this order: FirstName + LastName + DOB + ZIP
3. Hash the concatenated string using SHA-256, UTF-8, and Base64.

Example: Danielle Johnson, DOB July 4, 1985, ZIP 91790.

Concatenated string: 5dUD1FgiKcTJq+JQ5JZUdlyIXrSbtJ338YYbt5/HNG4=K+TjOqPiH2/3rRRPj9WCKKHM47UDQLSAX/DGNIDuxIg=IWi7qxOAbBJe0fNciDj76Eg84gmj40rB7aNMK/VnFOI=2FPZucR4x7U8KlM+SFAX4LPGhwNz/PIZUCSUdDh0o/s=

Final hash: PQOfn1RffEKmqMmNAzDKKaoZCwxWbQZkQzPWmQo9REA=

NameVIN: Name + VIN

1. Standardize and hash each field separately (SHA-256, UTF-8, Base64).
2. Concatenate the three Base64 hashes in this order: FirstName + LastName + VIN
3. Hash the concatenated string using the same method.

Example: Eve Genesis, VIN, 1HGCM82633A004352.

Concatenated string: hSYq33RRi7twx8uUzWFZ2RZp5age3x7+vVQ+rb2p+is=ruutSnlvzC4V3ExgYbRe2bNz8mrfx5jKfS2MxYGCcY4=iNswy1m+0VSt8jAfFrvaiQ1R/0HAbgSwNGkwqo6QBss=
Final hash: rtnDuXIe63jXYQQXW5r07GJ7lSsrib8+46QuKFwkOmk=

Use the Standardization and Hashing Tool in the DROP Sandbox to verify your implementation of the standardization and hashing requirements.