California's Delete Act & the DROP portal: your guide to deleting broker data in 2026

California's Delete Act 2026 creates a single-delete workflow through the California Privacy Protection Agency's DROP portal, replacing fragmented one-by-one requests for many registered brokers.

What the Delete Act changes in 2026

The California Delete Act expanded consumer control over broker data by requiring registered brokers to accept deletion instructions sent through a central state-run mechanism. Instead of filing dozens of separate requests, eligible California residents can submit one request through DROP and have it routed across participating brokers.

How the DROP portal works

DROP is designed as a single request channel. Once identity and eligibility are validated, one submission is distributed to all brokers covered by the system. Registration and enforcement milestones are handled by the state, while brokers process each request in recurring 45-day cycles.

What to expect from timelines

  • One request can apply to all registered brokers in the state system.
  • Brokers must align with registration deadlines and response obligations set by regulators.
  • Processing generally runs in 45-day compliance cycles, not instant deletion.
  • Some records can reappear from upstream sources, so monitoring remains necessary.

Penalties for non-compliance

Brokers that fail to register, ignore DELETE requests, or miss required response timelines can face significant civil penalties and regulatory action. For consumers, this matters because the law creates a real enforcement path when a broker refuses to comply.

Consumer checklist: using Delete Act rights effectively

  • Confirm eligibility and complete identity verification carefully.
  • Submit the request through DROP and keep confirmation records.
  • Check exposure again after the first 45-day cycle.
  • Track listings that fall outside DROP coverage and remove those separately.
  • Repeat checks after moves, new utilities, or phone changes.

Why this still matters for family privacy

Delete Act workflows reduce friction, but families still need visibility into where data persists. Relatives, address history, and phone-linked records can reconnect exposure even after a valid delete request.

Next step

Run Hardline's Free Exposure Scan to identify records that may be covered by DROP and the broker listings that still require direct removal.

Run Free Exposure Scan

Map broker exposure first, then use Delete Act rights with a documented workflow.

Run Free Exposure Scan