It depends on the route. A people-search site's own opt-out often takes effect within days: in Consumer Reports' 2023 test, most of the profiles that came down after manual opt-outs were gone within a week. A formal deletion request under a state privacy law has a legal deadline instead. In California a business has 45 calendar days to respond, extendable once by another 45 if it tells you, and an opt-out of sale or sharing must be honored within 15 business days. California's DROP platform runs on its own schedule. This article sets out each timeline and what to do when one passes.
Opt-out forms on people-search sites
A site's own opt-out form is not usually governed by a statutory deadline, so the timing is whatever the site does. The best evidence is Consumer Reports' study, in which researchers opted four volunteers out of 13 people-search sites by hand and checked back three times:
- After one week, 33 of the 47 profiles they had found were down.
- After one month, three more were down.
- After four months, none further had come down.
The pattern is worth knowing: in that test, a listing that was still up after a month did not come down later by itself. If a listing is still there a few weeks after you confirmed the opt-out, follow up rather than wait. Our per-site guides, such as Spokeo, Whitepages, BeenVerified and PeopleFinders, describe each site's process.
Search engines can lag behind. A page that is gone from the site can still appear in search results for a while. Google's "Refresh outdated content" tool lets you ask it to update a result for a page that no longer exists or has changed.
California: CCPA deadlines
The California Consumer Privacy Act and its regulations set three clocks.
- Confirmation of receipt: 10 business days. "No later than 10 business days after receiving a request to delete," a business must confirm receipt and explain how it will process the request, including its verification process and when you should expect a response.
- Response to a deletion request: 45 calendar days. The business must act "within 45 days of receiving a verifiable consumer request." The period "may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period." The Attorney General summarizes this as 90 days in total if they notify you.
- Opt-out of sale or sharing: 15 business days. A business must stop selling or sharing your information "as soon as feasibly possible, but no later than 15 business days from the date the business receives the request."
The 45-day clock runs from receipt, and the statute says the time the business spends deciding whether your request is verifiable does not extend it.
California: DROP
DROP, the state's Delete Request and Opt-out Platform, works on a cycle rather than a single deadline. According to CalPrivacy:
- Starting in August 2026, data brokers process deletion requests at least every 45 days.
- Brokers have up to 90 days to report back on your request.
- After that, brokers must re-check and delete new matching data at least every 45 days.
You can see each broker's status for your request on the DROP site; our DROP guide explains what each status means. DROP covers only brokers registered in California, so requests to other sites keep their own timelines.
Other US states
Several other states give a right to delete under a comprehensive privacy law, and the deadline is commonly 45 days. Virginia's law is an example: a business must respond "without undue delay, but in all cases within 45 days of receipt of the request," and may extend by "45 additional days when reasonably necessary." If it declines to act, it must offer an appeal, and it has 60 days to decide the appeal. If the appeal is denied, it must tell you how to contact the Attorney General to submit a complaint.
Check your own state's law for its exact terms. Our free kit writes the "Other US state" letter with a 45-day response request and a reservation of your right to appeal.
United Kingdom
Under the UK GDPR, an organisation has one calendar month to respond to an erasure request. The Information Commissioner's Office says it "can take up to an extra two months" in certain circumstances, and should tell you within the first month if it needs more time and why.
What to do when a deadline passes
- Check your records. Confirm the date the business received the request, and whether it sent a confirmation or an extension notice.
- Search again. For a people-search site, check whether the listing is actually still up: How to check a removal worked.
- Follow up in writing. Reply to your original request, quote its date, and name the deadline that has passed.
- Use the appeal, if your state has one. Several state laws require the business to offer an appeal of a refusal.
- Complain to the regulator. In California, the Attorney General and the California Privacy Protection Agency enforce the CCPA.
A timeline in practice
For someone opting out of people-search sites and sending a CCPA request to a broker, a realistic sequence looks like this:
- Day 0: submit opt-out forms and send written requests. Note the dates.
- Within days: click the confirmation links the sites email you.
- Within 10 business days: expect a confirmation of receipt for each CCPA deletion request.
- About two to four weeks: search for yourself again on each site.
- Day 45: a CCPA response is due, unless the business notified you of an extension.
- Every few months after: check again, because information can reappear.
Removal is not guaranteed. Some brokers don't comply, and some miss their deadlines.