Can You Make Data Brokers Delete Your Personal Information?

Last updated 2 weeks ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

California’s deletion platform does not cover publicly available data; Connecticut’s attorney general says residents may ask covered companies to delete publicly available information assembled into profiles about them on public websites. Data brokers are companies that collect information about people and sell or share it. Spokeo and other people-search companies sued on September 17, 2026 to block Connecticut’s public-information deletion requirement.

California’s Delete Request and Opt-out Platform (DROP) lets eligible residents send one free request to more than 600 registered data brokers. A broker that finds a record matching the request must delete it and keep it deleted, subject to exemptions. Whether a broker must delete your information depends on the state where you live.

Your state determines what a broker must do

Data brokers collect personal information and sell or share it with others; people-search sites are one type of broker. People-search sites can sell reports built from other brokers’ information, public social-media profiles and government public records. California’s legal definition focuses on a business that collects and sells a consumer’s personal information without having a direct relationship with that consumer. That sets a broker apart from a retailer or other company where the person knowingly opened an account.

IAPP, the professional privacy association, reported on June 17, 2026 that twenty-three states had enacted comprehensive privacy laws, including four newcomers that year: Alabama, Louisiana, Oklahoma and Vermont. The Congressional Research Service’s August 29, 2025 report covers the earlier nineteen: California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. These laws give residents rights to request deletion and opt out of certain uses, with different coverage and requirements.

The newer laws have later start dates. Oklahoma’s new deletion rights take effect on January 1, 2027, as do Louisiana’s. Alabama’s law takes effect on May 1, 2027, and Vermont’s on January 1, 2028. Those later enactments do not make the new rights available before their start dates. Which rights apply depends on the resident’s state and on whether its law covers the company; the company’s address alone does not settle it. Check the state attorney general or privacy regulator’s consumer guidance before treating a company’s removal form as the full extent of the available rights.

Under the California Consumer Privacy Act, deletion means asking a covered business to remove collected personal information and tell its service providers to do the same, subject to exceptions. Opting out instead asks the business to stop selling or sharing the information. The CCPA’s deletion right applies to a covered business and its service providers; DROP supplies the separate California route that reaches registered brokers with a single request.

California: one request, continuing deletion

California residents qualify for DROP, including people whose permanent home is in California who are temporarily outside it. The state does not charge consumers to use DROP. For an eligible resident, the state platform is an alternative to paying someone to contact brokers individually.

Start at the official DROP page and follow its eligibility, profile and submission steps. Residency verification uses the California Identity Gateway, with an option to enter information directly or use an existing Login.gov account. The request itself requires a name, date of birth and ZIP code, while other identifiers can be added later. The residency check only establishes eligibility; brokers use the information in the request to look for matching records.

DROP launched on January 1, 2026, and brokers began processing requests on August 1, 2026. Brokers must access the platform at least once every 45 days to begin processing requests. The processing workflow requires them to report each request’s status within 45 days after downloading it. These processing cycles explain why pressing submit does not produce an immediate result from every company.

Status updates can take up to 90 days, and CalPrivacy, the state privacy regulator, expects brokers’ initial download and reporting cycle to be complete by November 2026. That November date is what the regulator expects, not a guarantee that every consumer’s information will be gone by then. Keep the request confirmation and review the broker-by-broker results as they appear.

DROP distinguishes deleted nonexempt information from information a broker is legally permitted to keep, and from records it cannot find. A broker that cannot make an exact match can report an opted-out result, meaning it still has the data but can no longer sell or share it. CalPrivacy tells brokers to report that result when more than one consumer is linked to the same identifier. With an exempted result, the question is which exception applies; with a record-not-found result, it is whether the broker had a matching record at all. A submitted request therefore does not mean every broker deleted the profile. Add relevant identifying information if the status suggests the broker could not locate the record.

After a match, the broker must repeat the deletion every 45 days, subject to exemptions. This continuing obligation is what makes the platform more than a one-time cleanup. Current and future brokers active in DROP are included in the request unless the consumer narrows its coverage.

Connecticut: current rights, later centralized tools

Connecticut’s Public Act 26-64 amended the Connecticut Data Privacy Act and created new laws, including one on data brokers. Those changes took effect on October 1, 2026. The attorney general’s current consumer guidance describes a right to delete personal data, whether residents supplied it directly or a company collected it from third parties. The guidance says that right extends to publicly available information that has been compiled into a consumer profile accessible through a public website or offered for sale, and to any inferences a company draws from that information. Those rights are used company by company; they are separate from the central broker-deletion system the state has scheduled for later.

Spokeo and other people-search companies sued Connecticut’s attorney general William Tong on September 17, 2026, challenging the public-information deletion provision on First Amendment grounds and asking the court to bar enforcement. Before relying on public-profile deletion, check the attorney general’s current guidance and the company’s explanation of how it is handling requests.

The Connecticut law protects residents acting in an individual or household context, rather than an employment context. Its general coverage includes businesses operating in Connecticut or targeting its residents that process at least 35,000 consumers’ data, process sensitive data, or offer consumers’ personal data for sale. Data processed solely to complete payment transactions is excluded from the first two coverage tests. A broker that offers personal data for sale can be covered without reaching the 35,000-consumer threshold.

The law exempts specified entities, including state and local governments, political committees, higher education institutions and financial institutions subject to the Gramm-Leach-Bliley Act. Nonprofits are generally exempt, but the exemption does not apply to the law’s consumer-health-data provisions. A denial may therefore mean the organization is not covered, not that it broke the law.

Beginning January 1, 2027, brokers selling or licensing brokered personal data in Connecticut must be registered with the Department of Consumer Protection, subject to statutory exceptions.

Connecticut’s Public Act 26-100 amended the data-broker law and requires that department’s commissioner to establish a free, accessible deletion mechanism by July 1, 2028. Beginning October 1, 2028, covered registered brokers must access that mechanism at least once every 45 days to examine deletion requests and updates. Those are future deadlines; they do not mean a consumer portal is available today. Use the company’s existing Connecticut privacy-request process for current rights, and check the Department of Consumer Protection for rollout updates.

A direct request starts with the privacy policy

California businesses must explain their deletion-request methods in their privacy policies, usually offering at least two ways to submit a request. A business operating exclusively online needs only an email address for submitting requests. Use the designated privacy channel rather than assuming a message to ordinary customer service starts the legal response clock.

Covered companies in Connecticut must explain consumers’ request channels in their privacy notices. Save a copy of the request and any response so a later complaint can identify what was asked and when.

A covered California business must verify that a deletion requester is the person whose information it holds. Additional information requested to verify identity can be used only for that verification purpose. A request for proof of identity is therefore not, by itself, a refusal.

California consumers can authorize another person or a registered business agent to make a request, but a company may require signed permission and direct confirmation or identity verification.

The Federal Trade Commission says paid people-search removal services perform opt-outs and recommends checking which sites they cover, whether they report results, and how often they remove new or returning information. A paid service does that work for the customer; paying it does not give the customer a broader legal right.

Why some information can remain

DROP does not require deletion of information given directly to a business, exempt information or publicly available information. An email address supplied to a business when signing up for offers is an example of first-party information outside that DROP request. Deleting that information takes a separate request to the business itself.

California’s direct deletion right also has exceptions for purposes such as completing a transaction, certain warranty or recall obligations, business security, compatible internal uses and legal obligations. Connecticut likewise permits some denials to preserve a requested product or service, expected internal operations, recalls, security and fraud prevention, or compliance with law. After a denial in either state, ask which exception the company is relying on for the specific information.

An opt-out on a people-search site stops the sale of existing information, which can appear for sale again when the public records behind it change. The FTC warns that ordinary people-search opt-outs can leave information in reports about relatives or neighbors. For sites outside a continuing deletion mechanism, check again and submit another opt-out if new information appears.

When a company refuses or does not respond

A direct California deletion request generally requires a response within 45 calendar days, with another 45 days allowed if the company gives notice. A covered Connecticut company must respond within 45 days and may extend the period by another 45 days under certain conditions. These deadlines apply to direct requests; DROP’s broker processing and status updates run on their own schedule.

First, confirm that the request reached the designated channel, then ask for the reason for any denial or missing response. Connecticut consumers can appeal a denial, and the company has 60 days after receiving the appeal to explain its action and reasons. If the appeal is denied, the company must provide information for contacting Connecticut’s attorney general.

California consumers can report privacy-law violations to the attorney general or CalPrivacy, but cannot sue over most California Consumer Privacy Act violations. Connecticut’s attorney general alone enforces its privacy act, and consumers cannot sue a company for violating that act. A complaint should identify the request, the company’s response and the disputed use or retention. Filing one does not guarantee that the regulator will obtain a remedy for the individual.