To opt out of data brokers, you send each broker a request to delete your information and stop selling it, either through its own opt-out form or in writing under your state's privacy law. There is no federal opt-out: Consumer Reports noted in 2024 that "no federal laws give consumers the right to 'opt out' of people-search sites." What you can require depends on where you live. California residents have the most tools, including a state platform that sends one request to every registered broker.
This article covers finding the brokers, the requests you can send, a letter you can adapt, and what a broker is allowed to refuse.
Step 1: Work out which brokers to contact
Data brokers fall into two groups for this purpose.
- Brokers that publish a profile you can see. People-search sites show a listing when you search your name. You can find yours, opt out, and check later. Start with How to remove yourself from people-search sites.
- Brokers that don't. Marketing, identity and risk brokers sell to businesses. You can't see what they hold, so you send a request and rely on their reply. Acxiom and Epsilon are marketing examples in our registry; LexisNexis Accurint is an investigator database.
To find brokers you would not otherwise know about, use the state registries. California requires every data broker to register each January, and its registry can be searched or downloaded in full. Vermont's registration must state the broker's opt-out method, if it has one, and whether it lets someone else opt out on your behalf. What is a data broker? lists the four state registries.
Step 2: Choose the request
If you live in California
The California Consumer Privacy Act gives you two rights that matter here. In the Attorney General's words, you may "request that businesses delete personal information they collected from you" and "request that businesses stop selling or sharing your personal information." A business that receives an opt-out "cannot sell or share your personal information after they receive your opt-out request unless you later provide authorization."
You can also use DROP, the state's Delete Request and Opt-out Platform, which sends one deletion request to every registered data broker. Brokers must start processing DROP requests from August 1, 2026, and then re-check and delete new matching data at least every 45 days. Our California DROP guide covers how to sign up and what DROP leaves out. A broker that is not registered with the state never sees a DROP request, so direct requests still have a place.
If you live in another state with a privacy law
Several states have comprehensive consumer privacy laws with a right to delete. Virginia's is typical of the form: the business must respond "within 45 days of receipt of the request," can extend that by "45 additional days when reasonably necessary," and must offer an appeal if it refuses. Whether your state has such a law, and what it exempts, varies. Our kit's "Other US state" letter asks for deletion under "my state's comprehensive consumer privacy law, and any equivalent right otherwise available to me."
If your state has no such law
You can still use a broker's own opt-out form. Many people-search sites offer one to anyone. For brokers without a form, a written request costs nothing to send, even where no statute obliges a reply.
Step 3: Send the request
Under the CCPA, a business must give you "at least two methods" to submit a request, such as a toll-free number, email address, web form or paper form; a business that operates only online and deals directly with consumers may offer only an email address. Use whichever channel the broker's privacy policy names. If it offers a web form and an email address, the email leaves you with a copy of exactly what you sent.
The letter below is the California version our free kit generates. The kit fills in your details and the broker's address in your browser, and it never sends what you type to us.
To: [the broker's privacy email address]
Subject: Request to delete personal information
I am requesting deletion of all personal information you hold
about me, and that you stop selling or sharing it.
Name: [your name]
City: [your city, state]
Profile URL: (paste the URL of your profile page here)
I am making this request under the California Consumer Privacy Act,
Civ. Code §1798.105 (deletion) and §1798.120 (opt-out of sale or
sharing). You must respond within 45 days of receipt.
Please confirm in writing when the deletion is complete.
Include enough to let the broker find you: a broker matches records on name plus address, phone or email. Don't send more than it needs. In particular, don't send an ID document unless the broker asks for one as part of verifying a deletion request, and then check that the request came from the broker's real domain.
Step 4: Track the reply
Under the CCPA regulations, a business must confirm receipt of a deletion request within 10 business days and respond within 45 calendar days. The statute allows it to extend that once by another 45 days if it tells you within the first 45. An opt-out of sale or sharing must be honored no later than 15 business days after the business receives it. How long does data broker removal take? covers the timelines in other places.
Record the date you sent each request, any confirmation, and the reply. If a deadline passes with no answer, that record is what you will need for a follow-up.
What a broker may refuse
A broker can lawfully keep some information, and the reply may say so.
- Unverified requests. A business may deny a deletion request if it cannot verify your identity, and it must tell you so. California's DROP handles this differently: a broker that can't match a DROP request must treat it as an opt-out of sale or sharing.
- Publicly available information. The CCPA's definition of personal information excludes "publicly available" information, which includes information "lawfully made available from federal, state, or local government records."
- Other exemptions. The Attorney General lists information needed to complete a transaction, information needed to comply with the law, and data covered by other laws such as medical information or consumer credit reporting data as common reasons to deny deletion.
A refusal is not always the end. If the business deleted part of your data, or opted you out of sales even while keeping some records, that still changes what it can do with them.
Then check, and repeat
For people-search sites, search for yourself again after a few weeks: How to check a removal worked. For the rest, a written confirmation is the evidence you have. Brokers can collect your information again after deleting it, which is why listings reappear and why the requests are worth repeating.
Removal is not guaranteed. Some brokers don't comply, and some data is legally exempt.