Dispatch #0003

By Nolan Rourke

September 4, 2026

THE COLD OPEN

On August 10, 2026, the California Privacy Protection Agency issued a stipulated order in matter ENF26-05-D-LO against LocateSmarter, LLC, a skip-tracing data supplier based in Cedar Falls, Iowa. Documented in the order: the company required consumers to submit a full name, a mailing address, and the last four digits of a Social Security number before processing an opt-out. The agency assessed $110,490 in penalties and collected a $6,000 unpaid annual registration fee. Out of nearly 40 million California residents, only a handful of consumers successfully processed an opt-out. The state mandated a remedy for this friction that became mandatory this month. It works by handing every registered broker a list.

THE MECHANISM

The Delete Request and Opt-Out Platform (DROP) opened for consumer submissions on January 1, 2026. As of August 1, 2026, every company on the California Data Broker Registry must use it. Delete Act regulation section 7612(a) dictates that brokers must access the platform and download consumer deletion lists at least once every 45 days. A Californian verifies residency through manual entry or Login.gov and supplies identifiers. CalPrivacy sorts these into six lists: NDZ, Email, Phone, MAID, NameVIN, and CTVID. The architecture normalizes every field to a published rule before hashing it. The algorithm hashes the normalized value using SHA-256 with UTF-8 input encoding and outputs it as Base64. The broker authenticates to the API, downloads a ZIP archive of UTF-8 CSV files, and runs identical hashing rules against its own internal records. The broker deletes matching records and returns a CSV status file. The audit surface consists entirely of the API logs. Everything between the download and the upload happens on the broker's isolated hardware.

THE STRUCTURAL PARALLEL

The New York City Taxi and Limousine Commission released historical trip and fare logs in 2014. Documented from Vijay Pandurangan's analysis: the agency applied an MD5 hash to roughly 19 million medallion numbers and 3 million hack licenses before release. The identifier spaces were small and format-constrained. Pandurangan generated a full lookup table in two minutes and reversed the entire dataset within an hour. The California government applied an unsalted cryptographic hash to a bounded identifier space and distributed the output to external parties. The DROP lists go exclusively to credentialed API key holders, which narrows the field of attackers. The restricted access doesn't change the structural vulnerability of the file.

THE HUMAN MECHANIC

This vulnerability operates independently of malicious intent. Every 45 days, a compliance engineer at a registered broker pulls a ZIP archive, runs a hashing job across the company's records, and executes the deletions. Independent third-party audits examining these methodologies don't begin until January 1, 2028. A state-supplied file of hashed identifiers sits on the engineer's disk. Beside it sits a functional hashing pipeline built to the state's exact specifications. Matching that file against the company's full identity graph requires running the identical query against a different table. The design fails to prevent it, and the audit surface lacks the visibility to record it.

THE STRUCTURAL FLAW

The confidentiality of the DROP deletion list relies entirely on a legal use restriction and an unsalted hash over enumerable identifier spaces. The valid North American numbering plan holds roughly 6.3 billion numbers. Computing MD5 hashes for all valid phone numbers takes just over four hours on a standard laptop. Any party holding the Phone list possesses the capability to recover the plaintext number behind every entry. A reversed Phone list functions as a continuously updated roster of verified California residents.

THE COUNTERMEASURE & ITS LIMITATIONS

Filing a DROP request takes under ten minutes and establishes a standing deletion obligation across every registered broker on a 45-day cycle. The protection has limits. It fails to reach unregistered brokers, first-party collectors, or information claimed under an enumerated exemption. Supplying a phone number places the user on the most highly enumerable list. Supplying only an email address sacrifices coverage, as the phone number serves as the primary join key across the location and telecom broker market. For privacy engineers operating inside a registered broker, the only effective control is strict isolation. Keep the downloaded lists and the API key in a logged enclave held apart from the production identity graph.

THE CLOSE

CalPrivacy fined LocateSmarter for violating data minimization principles. Under DROP, more than 600 companies receive a hashed list of every resident who opted out. A legal rule and a vulnerable algorithm protect those identifiers. File the request. Understand the operational reality of the system you are joining. Stay paranoid.