Guidelines for a new reason code for DROP requests

What is DROP?


DROP (Delete Request and Opt-Out Platform) is a platform created by the California Privacy Protection Agency (CPPA) under California's Delete Act. It enables California residents (consumers/end users) to submit a single request directing all registered data brokers to delete their personal information and, where required, stop selling or sharing it. As such, DROP serves as the mechanism through which registered data brokers receive and process these requests.

When an end user's information submitted through DROP matches a data broker's records, the data broker is required to delete that individual's personal information. As a registered data broker, Telesign is required to regularly check DROP requests and process applicable matches.

What's changing?

You may start seeing transaction blocks for two of our services, Phone ID and Intelligence, involving end users who have submitted a DROP request.

Transactions for Intelligence and PhoneID with status code 10041 and for PhoneID Live -40032 indicates that the transaction has been blocked due to legal and compliance requirements. When these status codes are returned, Telesign will not provide the requested PhoneID or Intelligence output for that transaction.

A blocked transaction with status codes 10041 and -40032 are not billable and will not be counted towards API usage.



Required action on your side 



When you receive 10041 or -40032 status codes for an end user, you should assess your own legal obligations regarding the end user’s personal information, including whether deletion, de-identification, or other restrictions are required under laws applicable to you.



Summary

1. You may receive the new status code 10041 for Phone ID and Intelligence transactions, and -40032 for PhoneID Live transactions, when a transaction is blocked due to legal and compliance requirements under the California Delete Act.
2. Affected transactions are not billable.
3. You should assess your own legal obligations regarding the deletion or de-identification of the affected end user's personal information before continuing to use that information.