If a data broker hasn't answered your removal request, first work out whether its deadline has actually passed. Under California's CCPA and most other state privacy laws the deadline is 45 days from receipt, with one extension allowed if the company tells you. Once it has passed, send one dated follow-up, use the company's appeal process if your state's law has one, and then file a complaint with the regulator that enforces the law you relied on. Keep copies of everything, because the regulator will ask for them.
Step 1: Check the clock
Silence isn't always a violation. Before you escalate, check which deadline applies:
- California (CCPA). The business must confirm receipt within 10 business days, and respond within 45 calendar days. It can take up to 90 days in total if it gives you notice and an explanation (11 CCR §7021). An opt-out of sale or sharing must be honored within 15 business days (11 CCR §7026(f)).
- Other US states with privacy laws. Virginia's law, which many others follow, sets 45 days with one 45-day extension, and 60 days to answer an appeal (Code of Virginia §59.1-577). See state privacy laws with a right to delete.
- UK and EU. One month, extendable by two further months for complex requests. See the UK and EU erasure template.
- Canada. See PIPEDA and Canadian privacy requests.
A site that only offers a web form, and never sends an email, may have processed your request without telling you. Search for your listing again before you assume nothing happened. Our article on checking whether a removal worked covers how.
Step 2: Build the record
A complaint is only as strong as its paper trail. Collect:
- The request you sent, with the date and the address or form you used.
- Any auto-reply, ticket number or confirmation screen.
- The URL of the listing, and a screenshot of it taken after the deadline passed.
- Any reply refusing the request, or asking for more information.
Step 3: Send one follow-up
A short follow-up gives the company a last chance and gives you evidence that you tried. This one is built on the same letter the free OptStub kit writes; the legal paragraph is the California version, so swap in the paragraph from your own letter if you used a different law.
To: [the same privacy request address]
Subject: Follow-up: request to delete personal information, sent [date]
On [date] I sent you a request to delete all personal information
you hold about me, and to stop selling or sharing it. A copy is
below. I have not received a response.
Name: [your name]
City: [your city, state]
Profile URL: [the listing URL]
I am making this request under the California Consumer Privacy Act,
Civ. Code §1798.105 (deletion) and §1798.120 (opt-out of sale or
sharing). You must respond within 45 days of receipt.
The response period has now passed. Please confirm in writing when
the deletion is complete, or explain the basis for any refusal.
If I do not hear from you, I intend to file a complaint with the
regulator responsible for this law.
[paste your original request]
If your state's law has an appeal process and the company refused you, use it. Under Virginia's law the company must answer an appeal within 60 days and, if it denies it, tell you how to submit a complaint to the Attorney General.
Step 4: File with the right regulator
California
File a complaint with CalPrivacy, the California Privacy Protection Agency, through its online form. CalPrivacy says it "doesn't represent individual consumers and cannot act as your attorney," but that complaints help it decide on inquiries, sweeps and investigations. The California Attorney General also enforces the CCPA and takes complaints.
If the site looks like a data broker but isn't in the state's Data Broker Registry, CalPrivacy says consumers "should report it via the agency's complaint form" (enforcement advisory, December 17, 2025). Californians can also file one request to every registered broker through California DROP.
There is no lawsuit route for this under the CCPA: its private right of action covers certain data breaches only (Civ. Code §1798.150(c)).
Other US states
Complain to your state Attorney General, which enforces the state's privacy law. Connecticut, for example, asks consumers to choose "Consumer Data Privacy" on its online complaint form.
Some states also keep a registry of data brokers. Texas's Secretary of State maintains one, but says it "does not have the authority to regulate the business practices of a data broker" or investigate violations. Oregon's registry is run by the Division of Financial Regulation and lists registered brokers' opt-out information. A registry is useful for finding a broker's official contact, not for enforcement.
The FTC
You can report a company to the FTC at ReportFraud.ftc.gov. Be clear about what that does: the FTC says it can't resolve individual reports, but uses them to investigate and bring cases.
United Kingdom
The ICO asks you to "raise your concern with the organisation first and give them a chance to put things right." After that, you can complain to the ICO.
European Union
GDPR Article 77 gives you the right to lodge a complaint with a supervisory authority, in particular in the member state where you live or work or where the alleged infringement happened. The European Data Protection Board lists each national authority.
Canada
The Office of the Privacy Commissioner says to try to resolve the issue with the organization first, and then file a complaint through its online system. It also warns of "processing delays of several months." Quebec residents have a separate route through the Commission d'accès à l'information, with a 30-day filing window.
What a complaint can and can't do
A regulator complaint creates a record and can lead to an inquiry, but none of these agencies acts as your lawyer, and none promises an outcome on your individual listing. Some brokers also refuse legitimately: information from government records is often excluded from privacy laws, and data covered by the FCRA has its own rules (see what background check companies can keep).
Removal is not guaranteed, and a listing that comes down can come back: as the National Network to End Domestic Violence's Safety Net Project puts it, information "may eventually re-appear" because of new data coming in. It's worth searching for your name again a few months after any request, whether it was answered or not.