Data Broker Opt Out: Registries, Rights and Proof

A data broker opt out is a request, made to a business that sells personal information about people it has no direct relationship with, to delete your data or stop selling it. It works best when you begin at the public registers that list those businesses, use the legal right you actually hold, and then verify the result instead of trusting a confirmation email. In the United States the strongest levers are state registries, California's privacy rights and, for California residents, a single deletion platform called DROP.

A data broker is, in the words of the California Attorney General, a business that knowingly collects and sells the personal information of consumers it has no direct relationship with. That definition matters because it tells you where to look. Businesses that fit it are required to register in a handful of states, and those registrations are public. A registry is therefore the nearest thing to a map you will find, and it is the part most opt-out guides skip.

This guide covers the legal and procedural side of opting out: what the registries publish and what they do not, which rights each official page describes, how California's DROP statuses should be read, how to prove a request worked, and why records return. It does not list sites to search for people, and it does not explain how anyone is located, because that would help the wrong reader. Every rule is described as of the official page named beside it. These pages change, so check the live version before you file. This is information, not legal advice.

The short version

Registries show who brokers are and, in some states, how they say you can opt out. They do not remove anything by themselves, and one state's registry page says its office cannot regulate broker practices.
Choose the strongest instrument you hold: a California rights request, a California DROP submission if you live there, or a plain opt-out where no statute applies.
A status of "deleted" or a confirmation email is a claim. Check the result yourself on a schedule, and keep a dated record.
Records return because brokers rebuild from new sources. Plan a recurring check, not a single sweep.

What a registry tells you that a list of sites cannot

A registry tells you which businesses declare themselves data brokers, what they say they collect and, in some states, how they say you can opt out. It is a primary source maintained by a public body, so it is more reliable than a list compiled by a vendor who sells removal.

Its limits are just as important. A registry records a declaration. It is not a certificate that a broker is honest, and it does not mean a business that is missing from the list holds nothing about you. A broker outside every registration law can operate without appearing anywhere, so the registry is a starting point, never the full list.

A registry gives you the correct legal name and contact route of a broker, so a request goes to the right entity instead of a lookalike site. It also tells you what a broker says it collects, which decides whether a deletion request is worth the effort.

15 business daysthe longest a California business has to act on an opt-out of sale or sharing

45 dayshow often California brokers must check DROP for new deletion requests

90 dayshow long a DROP status update may take to appear

California Attorney General's CCPA page and the California Privacy Protection Agency's DROP pages, read for this guide.

Four state registries compared, and what each page says

Several states run a broker registry, and the official pages differ a lot in what they give a consumer. The table below reflects only what each page said when it was read for this guide.

State	What the page says	What a consumer can use	Gap
California	Public registry. Brokers register annually, between January 1 and January 31, for the prior calendar year.	Filter by data categories collected or recipients, view each broker's details, download the registration file	A registration is a declaration, not proof of compliance
Vermont	Annual registration between January 1 and January 31, under 9 V.S.A. chapter 62, subchapter 5	The definition of a broker	The page does not say what is published or give opt-out information
Texas	Central searchable registry kept by the Secretary of State. Brokers must post a notice on their site or app	The registry and the posted notice	The page says the office has no authority to regulate a broker's business practices, and gives no opt-out information
Oregon	Registration required under House Bill 2052. Brokers submit a short opt-out narrative	The posted narrative, which describes how consumers can opt out of collection, sale and licensing	Narrative is brief and written by the broker

California

The California Privacy Protection Agency's registry page says registered brokers report details about their business, the data they collect and who they sell or share it with. The registry previews contact information and consumer request metrics, and the full set of responses can be downloaded as a file. You can filter by the kinds of data collected, such as precise geolocation or government identifiers, and by the kinds of recipients. That filter is the useful part: it lets you rank brokers by what they say they hold about people, so you spend your effort where the stakes are highest. The page also points to DROP and says brokers must begin processing deletion requests on August 1, 2026.

Vermont and Texas

The Vermont Secretary of State's data broker page defines a broker as a business that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer, and says annual registration is required each January. It did not describe what the state publishes or give opt-out guidance, so for this guide it is a legal reference, not a consumer tool.

The Texas Secretary of State's data broker page says brokers must register to do business in Texas, must post a conspicuous notice on a website or mobile app, and must keep an information security program. It also states that the office does not have the authority to regulate a broker's business practices. Treat that sentence as the honest summary of what a registry is: a list, not an enforcer.

Oregon

The Oregon Division of Financial Regulation's registry page is the most consumer-oriented of the four. Under House Bill 2052, brokers must register before collecting, selling or licensing brokered personal data in Oregon, and the application must include a narrative of fewer than 600 characters describing how consumers can opt out of the collection, sale and licensing of their data. The division publishes the narrative on its website, and the page says a broker that changes its opt-out methods should notify the division so the text stays accurate. That is a rare thing in a registry: an official description of the broker's own opt-out method.

How to read one registration before you write to a broker

Reading a registration before you write takes a few minutes and changes what you ask for. The steps below assume a registry that publishes details, as California's does.

Reading a registration before you file

Match the legal nameCopy the exact registered name and the contact route from the registry. Send the request to that entity and its stated channel, not to a similar-looking site.
Read the data categoriesNote whether the broker says it holds sensitive categories such as precise location or government identifiers. These decide how urgent the request is.
Read who receives the dataThe recipient categories tell you whether deletion at this one business will matter, or whether the data has already moved downstream.
Look for a stated opt-out methodWhere the page publishes one, as in Oregon, use that method first and keep a copy of the text you relied on.
Record the date and the sourceWrite the date, the registry page and the exact name in your log. If the broker later disputes your request, the log is your evidence.

One caution applies to the whole exercise. Do not use a registry to look up information about other people, and do not submit anyone else's details to a broker without their consent. A request for another adult needs their authorization, and the California Attorney General's page says a business may require proof of permission or direct confirmation from you when an authorized agent files.

Your rights as the official pages describe them

The right you hold decides the deadline, the proof the business may ask for and the escalation route. The only statute-level source read in full for this section is the California Attorney General's CCPA page, so the details below are California's. For other states, the sources read for this guide did not cover each state's law, so check your own attorney general's page before citing a right.

The California page lists the right to know what a business has collected, used, shared or sold, the right to delete personal information collected from you with some exceptions, the right to opt out of sale or sharing, the right to correct, and the right to limit use of sensitive information. It adds that you can make a request to know up to twice a year, free of charge.

Several procedural points on the page are easy to miss.

A business must offer at least two request methods. Use a designated method, not a general customer service contact.
You cannot be required to create an account to submit a request, though a business may require you to use an existing account.
For deletion, correction and know requests, a business must verify you are the consumer and may ask for additional information, used only for verification. For opt-out requests it does not have to verify your identity, though it may ask basic questions to locate your information.
Know, delete and correct requests must be answered within 45 calendar days, extendable by 45 days if the business notifies you. Opt-out requests must be handled as soon as feasible and no later than 15 business days.
A browser-level global privacy control signal counts as an opt-out of sale or sharing.

The verification asymmetry is the practical heart of it. An opt-out of sale and sharing is cheap and needs little proof, so it is a sensible first move against a broker you cannot yet identify precisely. A deletion request asks for more proof, which means giving the broker more data about you. Send the least that lets the broker find the record.

DROP: what it asks, what each status means

California's Delete Request and Opt-out Platform lets a California resident send one deletion request to the registered brokers. The useful question is what happens after you press submit, and the agency's how DROP works page is detailed on that.

Only California residents qualify. Residency is verified through the California Identity Gateway, and the page says DROP does not create an account or store your personal information during that check. You must give a name, date of birth and ZIP code. Email, phone number, a mobile advertising ID, a connected TV ID and a vehicle identification number are optional. You receive an eight-digit DROP ID, which the page tells you to save and not share.

Brokers compare what you submitted with their records. On a match, the page says they delete your non-exempt personal information, including inferences, not just the fields you supplied. If there is no match, they must keep your request on file and keep your information out of their systems, so you do not resubmit. The page says brokers must re-check at least every 45 days and delete new matching data. DROP is ongoing, not a one-time action. The agency's overview page adds that all brokers in DROP should have completed their initial download and upload cycle by November 2026.

Status	What the page says it means	What to do next
Deleted	Matched, and non-exempt data was deleted	Verify at the source in a few weeks
Exempted	The broker holds data but is legally allowed to keep all of it	Note it. Use a direct request only if you have a ground beyond the exemption
Opted-out	No exact match, so the broker keeps the data but can no longer sell or share it	Add the identifiers that might match, then update your profile
Record not found	The broker could not locate you with the information provided	Add more identifiers you are comfortable sharing
Pending	Not yet processed	Wait. Updates can take up to 90 days

Two limits are stated on the page. DROP does not cover first-party data you gave a business directly, data an exemption lets the broker keep, or publicly available data. And because the platform reaches the brokers in the registry, a business outside the registry is outside DROP.

The "Opted-out" and "Record not found" rows are both about the match. More accurate identifiers make a match likelier, but each one is data you place in the system. The page says you can edit your profile to add a new phone number, email, device or car, and exclude a broker by unchecking it on the broker list page. Share only what you are willing to see matched.

Verifying a request worked, instead of trusting the status

Verification means checking the outcome at the source, on a schedule, with a record. A status inside a platform or an email from a broker is a statement by the party being asked to comply. It is useful, but it is not proof.

The method is the same for any lane. Two checks cover most cases.

Check the source. After the stated processing time, look for the record in the place it appeared, using only your own details. Do not search for other people.
Check the paper trail. Keep the request date, the channel used, the reference number, the response and the date you re-checked. If a business ignored a deadline, this is what you attach to a complaint.

When a business does not respond, the California Attorney General's page suggests checking that you used the designated method, following up in writing and trying another designated method. You can file a complaint with the Attorney General's office, which does not represent individuals or give individual advice but uses complaints to identify patterns, and with the California Privacy Protection Agency for violations on or after July 1, 2023. The page says private lawsuits are generally limited to certain data breaches.

Situation	Best instrument	Proof asked of you	Typical wait
California resident, many brokers	DROP	Residency check, name, date of birth, ZIP code	Up to 90 days for statuses
California resident, one known broker	CCPA deletion request	Verification as the business sets it	45 days, extendable by 45
California resident, wants sale stopped fast	Opt-out of sale or sharing	Basic questions only	No later than 15 business days
Elsewhere in the US	The broker's own opt-out, per its registration or site	Whatever the broker asks	Varies and is not a legal deadline

Why records come back after a successful opt-out

Records return because brokers do not hold one copy of you. They build profiles from many sources, and a deletion at one broker leaves every source intact. The agency's own DROP page makes the same point from the other side: it says brokers must re-check and delete new matching data, because new data keeps arriving.

Four causes explain most relisting.

A source still holds the record. Public registers, and data bought from other brokers, feed the profile again. The remedy is to reduce the source where an official route exists.
A broker you did not contact buys from one you did. Deletion at the first does not reach the second. A registry-based list helps, and DROP reaches registered brokers in bulk for Californians.
A new identifier arrived. A new phone number, email or address creates a new record that no earlier request mentioned. Update your DROP profile or file again for the new detail.
An exemption applies. Where a broker may lawfully keep the data, no request will remove it.

None of this is a failure of the opt-out. It is how the market works, and the honest plan is a cadence: a check a few weeks after filing, again after the longest stated processing period, and again after any change of contact detail. For broker records themselves, a calendar reminder and your own log are enough for most people. Monitoring how your name appears in search and AI answers is a separate job, described under reputation monitoring.

A realistic timeline

The sequence below uses invented, generic timing. Real timing depends on the broker, the state and the lane you use, so read every figure as an example, not a promise. The dates inside the platform follow the agency's published periods.

When	What happens	Your action
Day 0	You submit to DROP and receive an ID. Status shows pending	Save the ID. Open a log
Day 1 to 15	You send an opt-out of sale to two named brokers outside the platform	Log channel, date and reference
Day 15	The outer limit for an opt-out of sale or sharing has passed	Follow up in writing if there is no reply
Day 45	Deadline for a CCPA deletion reply, unless extended	Check the extension notice, if any
Day 90	The longest period for a DROP status to appear	Read the statuses and act on each
Day 120	Source check on records, using your own details only	Refile anything that returned

An invented scenario with stated assumptions

Take an invented person, call her Nora, a California resident who has moved twice in five years. She wants fewer commercial files about her in circulation. These are the assumptions: she has a stable email, one phone number and no unusual safety concern. She is not in a dispute, and the goal is routine tidiness of her data, not a response to a threat.

She starts at the registry, filters for brokers that say they hold precise location data, and notes their registered names. She submits to DROP with her required details and one email, and saves the ID. A week later she sends a deletion request to one broker she has a reason to worry about, using its designated method, and records the reference.

At day 90 the statuses are mixed. Several read deleted. One reads exempted, which she notes without arguing, because the page says an exempted broker may legally keep the data. Two read record not found. Nora decides to add her old phone number to the profile, a deliberate choice because she is happy for it to be matched, and updates the profile. She does not add her vehicle identification number, because she sees no reason to place it in the system.

A later check finds one profile gone and a second still showing an old address. She does not conclude that DROP failed: the page says publicly available data is outside its scope, and the remaining entry is built from a register. She logs it and moves to the route for that source, a different subject. The result is typical in kind: some gone, some exempted, some untouched, and a record of why.

Your next step: one list and one first filing

Start with a list of the businesses you want to reach, taken from a registry, and then one filing in the strongest lane you hold. Do not start with ten forms in one afternoon. A single well-documented request teaches you how a broker responds.

If this is happening to you now

If a broker's file is exposing you to harassment, stalking or a threat, treat that as a safety matter first and contact the police before you start paperwork. If you want a second pair of eyes on what is exposed about you and in what order to act, a private review is the place to begin. Our private audit looks at what search engines and AI assistants show about your name.

Reputation Partners works on the search and AI side of exposure. Broker deletion is one input to that picture, and an opt-out will not decide what a news article says. Plan the two separately.

Questions people ask

Is a data broker opt out free?

DROP is described by the California Privacy Protection Agency as free, and a California request to know is free up to twice a year. The pages read for this guide state no fee for a broker opt-out. Paid services exist and charge for handling the repetition. Whether that is worth it depends on the time you can sustain, not on a better legal right: a paid service holds the same rights you do.

Does one opt-out cover every data broker?

No. An opt-out or deletion reaches the business you send it to. California's DROP sends one request to the registered brokers on its list, but a business outside the registry, or one that holds only exempt or publicly available data, is not covered. Expect to repeat the process for brokers that sit outside whatever platform you use.

How do I know the broker really deleted my data?

You can only check the outcome yourself. Look for the record at the source after the stated processing time, using only your own details, and compare it with what the broker told you. Keep the dated log. For DROP, read the status for each broker, then verify the ones marked deleted rather than assuming the status is final.

Why does my information reappear after I opt out?

Brokers rebuild profiles from public records and from other brokers, so a source that still holds your data can feed a new profile. A new phone number or address also creates a record no earlier request covered. DROP's own page says brokers must re-check at least every 45 days, which is why opting out is a recurring task.

Can someone else submit the request for me?

In California, the Attorney General's page says you can authorize another person or a business registered with the Secretary of State to submit requests, and a business may ask for proof of your signed permission or may require you to confirm directly. The agency's DROP overview page also says a parent or family member can submit for a child or relative.

What if a broker ignores my request?

First check that you used the broker's designated method, then follow up in writing and try a second designated method. In California you can then file a complaint with the Attorney General and with the California Privacy Protection Agency. The Attorney General's page says it does not represent individuals. Outside California, your own attorney general or consumer protection office is the place to ask.