How to Get Data Brokers to Delete Your Data

Data brokers collect information about you largely without your knowledge. A data broker buys and compiles information from online and offline sources about people it has no direct relationship with, builds a profile, and sells it — that's the business model. Getting out of those files is possible, but the route depends on which state you live in. California now has a single free request that reaches hundreds of brokers at once. In Texas, Vermont and Oregon, you work broker by broker. Here is what is in the files, and an ordered plan you can start this week.

What a data broker is, and what it holds on you

The California Privacy Protection Agency defines a data broker as is a business that gathers and sells consumer information the consumer did not give it directly. You never filled in a form for these companies. Somebody else sold your information, or a public record exposed it, or a company you actually do business with passed it along.

The agency lists broad categories for broker files: Social Security number, precise geolocation, browsing history, email addresses, phone numbers, interests, health-related information and shopping habits. Brokers also collect from businesses you deal with directly, including streaming playlists, grocery purchase history and viewing history.

Brokers don't stop at storing raw facts — they draw conclusions from them. The agency says those inferences can cover your political views, health history, family and relationship details, and financial habits, and count as personal information subject to deletion. Buyers are not only advertisers, employers, landlords and debt collectors; the agency warns brokers may also sell to buyers with malicious intent, such as hate groups, hostile foreign governments and scammers.

The scale was documented over a decade ago. In a May 2014 report, the Federal Trade Commission found that brokers "collect and store billions of data elements covering nearly every U.S. consumer." One broker in that study held information on more than 1.4 billion consumer transactions and 700 billion data elements; another was adding more than 3 billion new data points a month. Then-Chairwoman Edith Ramirez said brokers often know as much about us as our family and friends do, or more. Seven of the nine brokers studied had shared information with another broker in the study, which is why scrubbing yourself from one site does not clear you from the rest. The FTC's own verdict on the industry's opt-out offerings was blunt: the choices available were largely invisible and incomplete — a reason to start with an official state route before any manual, one-off effort.

California residents: use DROP first

California runs a state tool that sends one request to over 600 registered brokers, called the Delete Request and Opt-out Platform, or DROP. CalPrivacy describes it plainly: "DROP gives you more control over your data. You can tell data brokers to delete and not sell your personal information." The agency will never charge you to use it.

Eligibility is the hard limit: to file a deletion request in DROP you must be a California resident. You can file for someone else, though — a parent may submit for a child, or a family member for an elderly relative.

Two mechanics matter for your expectations. From August 1, 2026, brokers must access DROP at least once every 45 days to begin processing deletion requests. The how-it-works page makes clear this is not a one-time scrub: "After initial processing, data brokers must re-check and delete new matching data at least every 45 days." Your request extends automatically to brokers that register later, unless you narrow it. Brokers have up to 90 days to report back, so don't expect same-week results.

Even in California, DROP leaves gaps. It does not cover data you handed a business directly, known as first-party data. For that, you generally need to go straight to the company — see how to ask any company for a copy of your data for how that request works. CalPrivacy also excludes public records such as vehicle or real estate ownership or voting records, along with data governed by HIPAA, the Fair Credit Reporting Act and Gramm-Leach-Bliley — so medical records and credit files need separate routes. If a broker also has a direct relationship with you, it must delete what it obtained from other sources but not what you provided directly. Brokers that fail to delete face $200 per day, per consumer, plus enforcement costs.

Everywhere else: registries first, then opt-outs

Outside California, the state resources here are registries: searchable lists of companies that have declared themselves brokers. They are lookup tools, not deletion mechanisms. Use them to build your target list, then go to each company yourself.

In Texas, the Secretary of State explains that a broker must register with that office to conduct business in the state, and registration costs $300 a year. Brokers that run a website or app must post a conspicuous notice on it, which is usually where you find the opt-out link. On what the registry itself can't do, the Secretary of State is explicit: "The Secretary of State is the filing officer for data broker registration and does not have the authority to regulate the business practices of a data broker, investigate alleged violations by the data broker, or enforce the requirements referenced above."

Vermont publishes a public Data Broker Search. The Secretary of State's page defines a broker as a business that knowingly collects and sells or licenses the brokered personal information of a consumer with whom it has no direct relationship. That page lists two duties for registered brokers — annual registration between January 1 and January 31, and a duty to protect information — and does not list a state deletion portal.

Oregon goes further than a pure list. The Division of Financial Regulation says data brokers must offer you the option to opt out from the collection and sale or licensing of your data, and that residents have the right to know how to decline, which activities they can opt out of, and by what method. Brokers must also explain how someone can be authorized to act on your behalf.

The checklist: do this in one week

1. If you live in California, start with DROP. Go to privacy.ca.gov/drop before touching anything else. It is free, and one request reaches over 600 registered brokers.
2. Gather your identifiers first. The minimum, per CalPrivacy, is your name, date of birth and ZIP code. Optional fields include maiden names, multiple emails and phone numbers, mobile advertising IDs, connected TV IDs and vehicle identification numbers. More information makes deletion more likely.
3. Save your 8-digit DROP ID. The confirmation page shows it, and you'll need it to check status later.
4. Consider filing for relatives. A parent may submit for a child, or a family member for an elderly relative.
5. Build a target list from state registries. This is the main step outside California. Search the Texas registry, the Vermont Data Broker Search, and the Oregon license search. In Oregon, pull the whole list by selecting "DFR-Data Broker" from the Profession drop-down and "Data Broker" from License Type.
6. Work the list one broker at a time. Oregon's guidance describes the method: "Copy the weblink and paste it into a search engine such as Google. Typically, you will find an online form with steps on how to fill it out." In Texas, look for the broker's conspicuous notice on its own site or app. Log the date you submit each one.
7. Send separate requests for what the state route misses. In California, first-party data, public records, and data governed by HIPAA, the FCRA and Gramm-Leach-Bliley all sit outside DROP. In Texas, the Attorney General notes that consumer reporting agencies regulated under the Fair Credit Reporting Act are exempt from the Data Broker Act, so credit-file questions need a different route there too.
8. Check back and top up. Brokers have up to 90 days to report in DROP. A status of Opted-out means the broker could not make an exact match, so your data stays but cannot be sold — add more identifiers. A status of Exempted means the broker may legally keep everything it holds. Edit your DROP profile whenever your details change.

People-search sites and public records

A subset of brokers, known as people search sites, builds reports by combining other brokers' data with public social media information and government public records. The FTC's consumer guidance lists the source records: property, driving and voter-registration records, criminal records, civil actions and judgments, birth, marriage, divorce and death records, and professional licenses. From those sources, a report can surface your age and date of birth, other names you've used, current and past addresses, marital status, education and employment history, and the names and addresses of family members.

The FTC lays out the manual process in three steps: search for your name or identifying details on a people-search site, find the opt-out link on any report you locate, then repeat on other sites. It is candid about the limits: your information can still turn up in reports of relatives, neighbors or associates even after you opt out. The agency states, "opting out of people search sites doesn't delete your information from public records, so someone could find public records about you on a government website." Because source records change, it recommends checking periodically and filing a new opt-out request whenever new information turns up.

The same FTC page lays out two ways to do this: on your own, one site at a time, for free, or by paying a service to opt out for you. Its advice for anyone considering a paid service is to check how many sites it covers, whether it will report back on what it opted you out of, and how often it rescans for information that has reappeared.

If a broker ignores you

Texans escalate to the state Attorney General, which says it alone has authority to enforce the Act, through an online complaint form. Vermonters can go through the Attorney General's Consumer Assistance Program. Oregonians can file data privacy complaints with the Oregon Department of Justice.

CalPrivacy's own framing for California residents is realistic rather than triumphant: limiting how your data gets sold can reduce unwanted texts, calls or emails, not eliminate them entirely. The agency also warns you may see fewer targeted ads or personalized content once your data stops flowing — a trade worth knowing about before you file.