# California Privacy Protection Agency

**Canonical:** https://apis.io/providers/california-privacy-protection-agency/  
**Website:** https://cppa.ca.gov/  
**APIs profiled:** 1

The California Privacy Protection Agency (CPPA, branded CalPrivacy) is the state regulator that administers and enforces the California Consumer Privacy Act and the Delete Act. Under the Delete Act it operates DROP, the Delete Request and Opt-out Platform, through which California residents file a single deletion request that every registered data broker must process at least once every 45 days beginning August 1, 2026. Data brokers integrate with DROP through the DROP Data Broker API, a three-operation REST surface on api.drop.privacy.ca.gov (download hashed consumer deletion lists as a ZIP of CSVs, upload Id,Status response files, amend prior responses) authenticated with an X-API-KEY issued in the Data Broker Portal, with a sandbox environment, HMAC-SHA256 signed webhook notifications, and an OpenAPI 3.1.0 contract published alongside the technical specifications on privacy.ca.gov. The agency also publishes the California Data Broker Registry as downloadable CSV files.

## Kin Score — 59.7 / 100 (strong)

Scored 2026-09-18 under rubric 0.22.0. Trend: flat (+0.0 from 59.7).

| Facet | Score |
|---|---|
| Discoverability | 68.5 |
| Contract Quality | 66.4 |
| Contract Governance | 18.2 |
| Operational Transparency | 23.7 |
| Developer Ergonomics | 66.1 |
| Access Clarity | 65.8 |

Regulatory layer — **Government & Public Sector**: 57.4 (matched via tags).

## Agent readiness — 39.7 (agent-native)

| Dimension | Value |
|---|---|
| Spec Presence | yes |
| Agentic Access | no |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | bearer |
| Idempotency | documented |
| Error Semantics | verified |
| OpenAPI Examples | verified |
| Rate Limit Signal | verified |
| Event Surface Described | yes |
| Agent Skills | derived |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |
| Delegated Identity | no |
| Protected Resource Metadata | no |
| Dynamic Client Registration | no |
| Agentic Commerce | no |

## APIs (2)

- **DROP Data Broker API** — Delete Act data broker integration API for the Delete Request and Opt-out Platform (DROP). Data brokers pull a ZIP archive of hashed consumer identifiers (GET /data/download, on...
- **DROP Webhook Notifications** — Optional outbound HTTPS webhook notifications from DROP to a data broker's endpoint, enabled in the Data Broker Portal notification settings. Five event types (download.ready, u...

## MCP servers (1)

- **DROP Data Broker API (candidate MCP tool surface)**

## Security (3)

- **California Privacy Protection Agency Authentication** — apiKey · 1 scheme
- **California Privacy Protection Agency Domain Security** — TLSv1.2 · HSTS · DNSSEC · DMARC
- **California Privacy Protection Agency Vulnerability Disclosure** — security.txt · contact published

## Plans (1)

- **California Privacy Protection Agency Plans Pricing**

## Tags

Government, Privacy, Data Brokers, Regulatory Compliance, Data Deletion, Consumer Rights, California, Webhook

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/california-privacy-protection-agency/). Scores are computed from the provider's own public artifacts under a published rubric.