Data Broker Opt-Out List: Registries, Requests, and Removal

The closest thing to a master data broker opt-out list lives in four state registries — California, Vermont, Oregon, and Texas — that require brokers to register publicly and disclose how consumers can opt out. California’s registry is the largest and, starting in 2026, backs a single-request deletion tool that reaches every registered broker at once. Outside that tool, removing your data still means working through brokers one by one.

Where to Find the Actual List of Brokers

You don’t have to guess which companies hold your data. Four states require data brokers to register with a government agency, and those registries are open to anyone, regardless of where you live.

California

The California Privacy Protection Agency runs the largest registry. Every business meeting the state’s legal definition of a data broker must register annually between January 1 and January 31 and report on the prior year’s activities.¹ The registry is searchable online and lists each broker’s contact information and privacy request details. It grew out of the Delete Act, which the Legislature passed in 2023.²

Vermont

Vermont brokers register with the Secretary of State by January 31 each year. Registration filings disclose whether the broker allows consumers to opt out, the method for doing so, and the number of security breaches in the prior year.³

Oregon

Oregon requires brokers to register before collecting, selling, or licensing personal data in the state. Registration includes a description of the opt-out method, which the state publishes on its website.⁴

Texas

Texas registers brokers annually with the Secretary of State. The law applies to businesses that derive more than 50 percent of their revenue from processing personal data, or that process data on more than 50,000 individuals where the data wasn’t collected directly from those people. Registered brokers must post a data broker notice on their own website.⁵

Working through the California list first is usually the most efficient approach because it captures the broadest set of nationally operating brokers. The brokers themselves generally fall into three groups: people-search sites like Whitepages and Spokeo, which pull from public records and are the first hits when someone searches your name; marketing brokers like Acxiom and Epsilon, which aggregate purchasing and demographic data; and risk or financial data brokers like LexisNexis and CoreLogic, which supply background data for insurance, employment, and identity verification. The last group is more complicated because some of their activities fall under the Fair Credit Reporting Act, and state privacy opt-outs generally don’t override FCRA-regulated activities. If your issue is inaccurate data being used in a credit decision, that’s an FCRA dispute, not a privacy opt-out.

One Request That Reaches Every Registered California Broker

California’s Delete Request and Opt-out Platform, known as DROP, went live on January 1, 2026. It lets you submit a single verified deletion request that applies to every data broker registered in the state.⁶

Starting August 1, 2026, registered brokers must check DROP at least once every 31 days, process pending deletion requests, and direct their service providers to delete the same data. After the initial deletion, brokers must keep deleting any new personal information they collect about you at least once every 31 days, and they cannot sell or share newly acquired data about you unless you tell them otherwise.⁷ That rolling obligation is what makes DROP different from a one-time opt-out.

A federal version, the DELETE Act (H.R. 2612), was introduced in April 2025 but has only been referred to committee.

What to Gather Before You File Anything

Brokers match records against personal details, so the more complete your list, the fewer profiles slip through unnoticed.

Every full legal name, maiden name, and alias you’ve used.
Current and previous residential addresses going back at least ten years. Address history is the primary search key most brokers use.
All email addresses, active and old, and phone numbers, current and disconnected.
Date of birth, which brokers use to separate people with similar names in the same area.

Some brokers require identity verification beyond a form. This can include knowledge-based authentication, such as confirming past addresses or ages of relatives, partial Social Security numbers, or phone verification. The three major credit bureaus and companies like Acxiom use some form of enhanced verification before processing deletion requests. Be cautious if a broker asks for a full SSN or a government ID photo unless you have confirmed you’re on the company’s official site.

Submitting Requests Outside DROP

For brokers not covered by DROP, opting out means visiting each site individually. The opt-out link usually sits in the footer. California regulations require covered businesses to post either a “Do Not Sell or Share My Personal Information” link or a “Your Privacy Choices” link with the blue and white opt-out icon.⁸ Many brokers use similar labels even outside California.

The pattern is predictable. You fill in enough identifying detail for the broker to find your record, solve a CAPTCHA, and submit. Most brokers then send a verification email that you must click within 24 to 48 hours, or the request is discarded. That confirmation step is where most opt-out attempts quietly fail, so check your spam folder.

California businesses have 45 days to respond, with a possible 45-day extension if they notify you of the delay. Processing at brokers outside California’s jurisdiction is generally 30 to 45 days. After the window closes, search your name on the broker’s site to confirm the record is gone.

You can authorize someone else to submit requests for you. Under the CCPA, an authorized agent can act on your behalf, though brokers may require signed written permission and may ask you to verify your identity directly to confirm you authorized the agent.⁸ Paid removal services rely on this mechanism.

Suppression vs. Deletion

When a broker processes your request, the result is either deletion or suppression, and the difference matters.

Deletion removes your record entirely. Your data is gone, but so is any record of your preference. If the broker later purchases a data set that includes you, there’s nothing to flag you as opted out, and your profile gets rebuilt.

Suppression keeps a minimal identifying record and uses it as a filter against incoming data. When new information matching your identity arrives, the suppression record blocks it. You stay opted out as fresh data flows in. The tradeoff is that the broker still holds some information about you to run the filter.

Most brokers default to suppression, and for most consumers that’s the better result. California’s DROP goes further by requiring brokers to re-delete your data every 31 days and prohibiting them from selling or sharing newly collected data about you after your initial request.⁷

Global Privacy Control as a Background Layer

Global Privacy Control is a browser setting that sends a “do not sell or share” signal to every site you visit. California law requires businesses to treat a GPC signal as a legally valid opt-out.⁹ Several other state privacy laws include similar requirements.

GPC is built into some browsers and available as an extension for others. Once enabled, it works silently. The limit is scope: it only reaches sites you actually visit, so it doesn’t touch brokers whose websites you never interact with. Use it alongside direct opt-out requests, not as a replacement.

Paid Removal Services

Because working through dozens or hundreds of brokers is tedious, services like DeleteMe and Optery act as authorized agents. They submit requests for you and periodically rescan broker sites to confirm your data stays removed. Annual pricing generally runs from roughly $130 to $250 per person depending on the service and coverage.

They handle the repetitive work well but have limits. Brokers with enhanced identity verification, like the credit bureaus, often refuse third-party requests, so you’ll still submit those yourself. Paid services also can’t file through California’s DROP on your behalf unless they meet the authorized agent requirements under state law.

Why Your Data Keeps Coming Back

Opting out rarely sticks permanently. Brokers continuously buy fresh data from public records, loyalty programs, app developers, and other sources. If a broker deleted your record instead of suppressing it, your information re-enters the system the next time they ingest a data set that includes you. Even suppression can be defeated when new data arrives through channels that don’t match your suppression record precisely.

Plan to recheck the major people-search sites every three to six months. If your listing has reappeared, submit a new request. That cycle is exactly what California’s DROP is designed to break, since it obligates brokers to keep deleting your data on a rolling basis rather than treating opt-out as a single event.⁷ For residents of other states, the loop of opt-out, reappearance, and re-submission is the norm until similar laws catch up.

1
California Privacy Protection Agency. Data Broker Registry
2
California Privacy Protection Agency. Data Broker Registration Regulations
3
Vermont General Assembly. Vermont Code 9 VSA 2446 – Annual Registration
4
Division of Financial Regulation. Data Broker Registry
5
Office of the Attorney General of Texas. Texas Data Broker Act
6
privacy.ca.gov. Delete Request and Opt-out Platform (DROP)
7
LegiScan. CA SB362 2023-2024 Regular Session
8
California Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
9
Global Privacy Control. Global Privacy Control