How to Remove Your Data from Data Brokers: Delete Act, DROP, Opt-Outs

To remove your data from data brokers, combine three tools: a single official deletion request where your law provides one (California's DROP covers every registered broker), individual opt-outs on the people search sites that actually show your profile, and written erasure or objection requests where GDPR or a state privacy law applies. Then re-check on a schedule, because records come back.

No single step is complete on its own. California's Delete Request and Opt-out Platform (DROP) lets a resident send one request to more than 600 registered brokers, and since 1 August 2026 those brokers must pull the list at least every 45 days. It still leaves out public records, data you gave a company directly, and brokers outside the registry. Manual opt-outs reach the sites strangers actually search, but they relist. This post goes one level deeper than our look at the FTC data broker rule and its supply chain implications and our explainer on Global Privacy Control opt-out signals. It covers what brokers hold and where it comes from, what each law actually requires, how each removal route works in practice, the risks of the process itself, and a step by step plan with templates.

Key takeaways

• A data broker collects and sells personal information about people it has no direct relationship with, from Social Security numbers and precise geolocation to inferences about health, politics and finances.
• California's Delete Act (SB 362, Chapter 709, Statutes of 2023) created DROP. Residents could submit requests from 1 January 2026. Brokers had to start processing on 1 August 2026, must re-check the list at least every 45 days, and have up to 90 days to report a status. By November 2026, every broker in DROP should have completed its first download and upload cycle.
• A DROP status of "Opted-out" means the broker could not make an exact match: it may not sell or share your data but still holds it. More identifiers improve matching.
• DROP does not delete first-party data you gave a business directly, publicly available data, or data exempt under laws such as HIPAA, the Fair Credit Reporting Act and Gramm-Leach-Bliley.
• Four states require data broker registration: California, Oregon, Texas and Vermont, according to California's privacy agency. Oregon charges $600 a year; Texas charges $300. Only California pairs its registry with a one-request deletion system.
• At the federal level, the Protecting Americans' Data from Foreign Adversaries Act of 2024 bans brokers from making sensitive data available to China, Iran, North Korea and Russia, enforced by the FTC. The CFPB's proposal to treat many brokers as consumer reporting agencies was withdrawn on 15 May 2025.
• In the EU and UK, GDPR Article 21 gives an absolute right to stop direct marketing use, and Article 17 gives a right to erasure in defined cases. Controllers must answer within one month, extendable by two further months.
• Manual opt-outs on people search sites work but relist when public records change, as the FTC warns. Paid removal services are a convenience, not a guarantee.
• The process carries its own risk. Send the minimum identifiers and treat any "removal" offer that arrives by cold email as suspect.

What a data broker is and what it holds

California's Delete Act defines a data broker by reference to the California Consumer Privacy Act (CCPA): a business that knowingly collects and sells to third parties "the personal information of a consumer with whom the business does not have a direct relationship." The federal Protecting Americans' Data from Foreign Adversaries Act (PADFA) uses a similar test: an entity that, for valuable consideration, makes available data of US individuals "that the entity did not collect directly from such individuals." The common thread is the missing relationship. You never signed up with the broker. It got your information from somewhere else.

That covers several quite different businesses.

People search sites

People search sites, also called people finder sites, are the brokers most people meet first, because their profiles appear in ordinary web search results. The FTC describes them as data brokers that compile reports about people and sell them to anyone who pays. A report can include age and date of birth, other names used, current and past addresses, properties bought or sold, marital status, education, employment history, criminal and civil records (bankruptcies, liens, judgments) and the names and addresses of relatives. The FTC notes that a detailed report can often be pulled from a single identifier such as a name or phone number. That is why survivors of domestic violence and stalking treat these sites as a safety issue rather than a nuisance.

Marketing and audience brokers

Marketing brokers rarely publish profiles. They build segments ("likely new parents", "frequent travellers") and sell or license them to advertisers as lists or as audiences matched by hashed email, phone number or mobile advertising ID. California's privacy agency lists the inferences these brokers can draw from processed data: political views, health history inferred from searches about conditions such as pregnancy, cancer or diabetes, family details such as whether you have children, and financial habits including "predictions about how much you'd be willing to pay for a given product." Under California law those inferences are personal information too, and they are subject to deletion.

Location and device data brokers

Some brokers trade in location histories collected from phones. In January 2025 the FTC finalized an order prohibiting Gravy Analytics and its subsidiary Venntel from "selling, disclosing, or using sensitive location data," except in limited national security or law enforcement cases. The FTC alleged that the companies used geofencing to build and sell lists of people who visited healthcare facilities and places of worship. The Commission voted 5 to 0 to approve the final order. These records are keyed to device identifiers rather than names, which is why DROP lets you submit a mobile advertising ID.

Risk, identity and background data

A further group sells identity verification, fraud scoring and background check data. Much of it overlaps with consumer reporting, governed in the United States by the Fair Credit Reporting Act, which is why DROP lets brokers keep information that "affects your credit score".

Who buys it

According to California's privacy agency, buyers include advertisers, employers and recruiters, political campaigns, retailers, landlords and debt collectors, and potentially "buyers with malicious intent, such as hate groups, hostile foreign governments, and scammers."

Where brokers get your data

The sources matter because they decide which removal route can reach a record.

The FTC lists three main inputs for people search sites: other data brokers, public social media profiles and government public records. California's agency adds the commercial path, such as retailers and streaming services that collect purchase or viewing history, and draws the line that shapes what DROP can do. Information you give a business directly is "not subject to deletion by DROP", but "if this information was then purchased by a data broker, it is subject to deletion by DROP."

Apps and software development kits deserve a closer look because they are the least visible source. A mobile app can embed advertising, analytics or location code from a third party. That code runs with the app's permissions and can send device identifiers and location to its own servers. The person who installed a flashlight or weather app never dealt with the company receiving the data. This is the gap the FTC location cases describe, and it is the reason a mobile advertising ID is one of DROP's most useful optional fields.

The California Delete Act and DROP

What the Delete Act requires

California passed the first state data broker registration law in 2019 (AB 1202), with a public registry run by the Attorney General. The Delete Act, Senate Bill 362 (Chapter 709, Statutes of 2023), expanded it. CalPrivacy, the California Privacy Protection Agency, took over the registry in 2024. In 2025 the Legislature amended the Delete Act again with SB 361, which added registration disclosures.

The Act requires CalPrivacy to build a free platform that lets a consumer send one deletion request to every registered broker. It requires brokers to:

• Register with CalPrivacy every year between 1 and 31 January, for the previous calendar year's activity. The 2026 fee was $6,000 plus a third-party processing fee.
• Create a DROP account. Every broker that operated in 2025 or started in 2026 had to do so. A business that starts brokering after 1 August 2026 must create the account before it starts.
• From 1 August 2026, access DROP at least once every 45 days, download the consumer deletion lists (manually or by API), and process them. Brokers pay an access fee for this.
• Publish yearly request metrics in their privacy policy: how many deletion, access, "know what is sold" and opt-out requests they received, complied with and denied, and the mean and median response times.
• From 1 January 2028, and every three years after, undergo an independent audit of their compliance and submit the report on CalPrivacy's request. From 1 January 2029, disclose that audit status at registration.

SB 361 added disclosures that are useful to consumers reading the registry. Brokers must now say whether they collect sensitive types such as sexual orientation, union membership or citizenship status, whether they collect mobile advertising IDs, login or account information, and whether they have shared data with foreign actors, law enforcement or developers of generative AI systems.

Penalties are per day. CalPrivacy lists $200 per day for failing to register, plus unpaid fees and enforcement costs, and $200 per day, per consumer, for failing to delete, plus enforcement costs.

How CalPrivacy polices the registry

CalPrivacy's Enforcement Advisory 2025-01 says some brokers "hide the ball" by trading under several names or websites without listing them, or by pointing to a parent company's registration. Each broker, including each subsidiary, must register on its own and list every website and trade name in its DROP account. The agency's announcements page lists a run of fines and settlements with unregistered brokers. That matters to consumers: a broker that is not registered is not receiving DROP lists, so every enforcement action widens coverage.

The DROP timeline

How DROP works for a consumer

The official walkthrough has three steps.

1. Verify eligibility. DROP is for California residents, including people domiciled in California who are temporarily elsewhere. Residency is checked through the California Identity Gateway. You can enter information directly or sign in with an existing Login.gov account. CalPrivacy says you do not need a Gateway account and that the information is not retained by DROP. If verification fails, there is a link to request a manual eligibility review by email.
2. Create your profile. Only name, date of birth and ZIP code are required. Optional fields are email addresses, phone numbers, other names including maiden names, mobile advertising IDs (MAIDs), connected TV IDs and vehicle identification numbers (VINs). You can add several of everything except date of birth.
3. Submit. You receive an 8-digit DROP ID. Save it and do not share it. You need it to check status, and you can recover it by email.

A parent can submit for a child, and a family member can submit for an elderly relative, with permission. The residency of the person the request is for still has to be verified.

All current and future brokers active in DROP are included unless you narrow the request. If you want a specific broker to keep your data (say, a service you rely on), you can untick it on the broker list page.

What happens after you submit

From 1 August 2026, brokers download the list at least every 45 days and look for matches. If a broker finds you, it must delete all of the non-exempt information it holds about you, "not just the information you provided", including inferences. If it does not find you, it must keep your request on file and re-check: you do not resubmit. DROP describes this as "ongoing, not a one-time action."

To protect the request itself, DROP hashes what you enter, so brokers compare hashes against hashes of their own records without seeing the original values.

The statuses you will see:

The "Opted-out" status deserves a careful read. CalPrivacy gives the example of an email address shared by several people. If a broker cannot tie that email to one person, it stops selling or sharing the information of everyone who uses it, but it does not delete. More precise identifiers turn an opt-out into a deletion.

CalPrivacy's pages differ on how often you can edit a profile. The main walkthrough says you can come back and add information to your profile; the help page says updates are allowed once every 45 days. Plan on one batch of additions per cycle.

What DROP does not delete

DROP is a strong tool with clear edges, and CalPrivacy lists them:

• First-party data. If you created an account with a business and gave it your email, that business is not required to delete it because of a DROP request. Some brokers also sell products directly. For those, DROP removes what they got from other sources but not what you gave them. Use a CCPA deletion request for that part.
• Publicly available data. Public records such as vehicle or real estate ownership and voting records can be kept. The government copy is unaffected in any case.
• Exempt data. Health information covered by HIPAA, credit information covered by the FCRA and financial information covered by Gramm-Leach-Bliley sit under other laws. So does data needed to respond to a criminal or civil investigation.
• Unregistered brokers. DROP reaches brokers that registered. A broker that should have registered but did not is an enforcement matter, not a coverage you can count on.
• Brokers outside California law. DROP protects California residents. If you move, the requests you sent remain, but new residents of other states cannot use it.

Finding your identifiers

DROP's unique identifiers page explains where each optional ID lives:

• Android MAID: Settings, then Google, then Privacy and security (on Samsung: Security and privacy, then More privacy settings), then Ads. A MAID has 32 alphanumeric characters and four hyphens.
• iPhone and iPad: iOS does not show the IDFA, Apple's advertising identifier, in its interface. CalPrivacy notes that if "Allow Apps to Request to Track" under Settings, Privacy and Security, Tracking is off, the device does not currently have an IDFA, so there is nothing to enter. CalPrivacy says it does not require or advise using a third-party app to find one.
• Connected TV ID: in the TV's settings under Support, System information or Device information, labelled TV ID, unique ID or device ID. The location varies by brand.
• VIN: the 17-character code on the dashboard plate, the driver's door jamb sticker, your registration, title or insurance documents.

Other US states and federal law

State data broker registries

CalPrivacy's own Delete Act page says California is one of four states that require data broker registration, alongside Oregon, Texas and Vermont. None of the other three runs a single deletion mechanism like DROP. Their registries are still useful to consumers, because they are lists of businesses to contact and, in Oregon's case, a published summary of each broker's opt-out methods.

Oregon. HB 2052, passed in the 2023 session, requires a broker to register before collecting, selling or licensing "brokered personal data" about Oregon residents. Registration started on 1 January 2024. Brokered personal data includes name and family members' names, addresses, date or place of birth, mother's maiden name, biometric information, Social Security or other government identification numbers, and anything that alone or combined can be reasonably associated with the person. When a broker registers, it submits a narrative under 600 characters describing how consumers can opt out of collection, sale and licensing, and the Division of Financial Regulation publishes that narrative. That makes Oregon's registry a practical opt-out directory.

Texas. Chapter 510 of the Business and Commerce Code requires a data broker to register with the Secretary of State to do business in Texas. Section 510.004 requires a broker with a website or app to post a conspicuous notice in wording set by rule, and section 510.007 requires it to maintain a comprehensive information security program. The Secretary of State keeps a searchable registry. The office is clear about its limits: it is the filing officer, and it "does not have the authority to regulate the business practices of a data broker, investigate alleged violations by the data broker, or enforce" the requirements.

Vermont. Vermont's registry sits in 9 V.S.A. Chapter 62 and is run by the Secretary of State. The Legislature took up changes to the data broker rules in its 2025 to 2026 biennium (H.211), so check the Secretary of State's site for the current fee and filing rules before relying on any figure. The official statute pages were not reachable when we prepared this post.

Comprehensive state privacy laws. Many other states now have general consumer privacy laws with rights to delete and to opt out of sale or targeted advertising, for businesses over each law's thresholds. You must find and contact each broker yourself.

Federal law

There is no general federal data broker law in the United States. Three federal pieces matter.

PADFA. The Protecting Americans' Data from Foreign Adversaries Act of 2024 is Division I of Public Law 118-50, approved on 24 April 2024. It makes it unlawful for a data broker to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available "personally identifiable sensitive data" of a US individual to a foreign adversary country or an entity controlled by one. Control includes a 20 percent ownership stake. Sensitive data includes government identifiers, health and financial information, biometric and genetic data, precise geolocation (within 1,850 feet), private communications, login credentials, data about anyone under 17, online activity across sites and status as a member of the Armed Forces, among other categories. The FTC enforces it as an unfair or deceptive practice. The section took effect 60 days after enactment; the FTC's own letters give the date as 24 June 2024. On 9 February 2026 the FTC's Bureau of Consumer Protection sent warning letters to brokers, using a published template that focuses on products involving military status and asks recipients to review their practices. PADFA protects against one category of buyer. It gives individuals no right to deletion.

FTC enforcement under Section 5. Without a broker statute, the FTC uses its general power over unfair and deceptive practices. The Gravy Analytics and Venntel order of January 2025 is an example: it bans the sale of sensitive location data and requires a sensitive location data program.

The withdrawn CFPB rule. On 13 December 2024 the Consumer Financial Protection Bureau proposed amending Regulation V, which implements the Fair Credit Reporting Act, so that FCRA protections would apply to sensitive information "including information sold by data brokers." Comments closed on 3 March 2025. On 15 May 2025 the CFPB withdrew the proposal, saying legislative rulemaking was "not necessary or appropriate at this time" and that it would take no further action. If you read older guidance that treats the rule as pending, it is out of date.

What GDPR gives people in the EU and UK

People in the European Union and the United Kingdom do not need a broker registry to have rights against brokers. The General Data Protection Regulation (and the UK GDPR, which keeps the same structure) applies to any controller processing their data, including one that never dealt with them.

Article 21: the right to object

For data brokers, Article 21 is usually the stronger tool. The EDPB's guide for small businesses explains that a person can object to processing based on legitimate interests or a public task "on grounds relating to their particular situation", and the organisation must stop unless it can show compelling legitimate grounds that override the person's rights. Direct marketing is different. The UK ICO's guidance puts it plainly: individuals have "an absolute right to stop their data being used for direct marketing," including profiling related to direct marketing, with no exemptions and no grounds to refuse. Most marketing broker activity is direct marketing or profiling for it.

The ICO adds a detail that matters for anyone expecting a full wipe: an objection to direct marketing "does not automatically mean that you need to erase the individual's personal data." In most cases the organisation will keep a minimal suppression record so it can keep honouring the objection. That suppression record is a feature. Without it, the next list a broker buys could re-add you.

Article 17: the right to erasure

Article 17 gives a right to have personal data erased in defined circumstances. The ones that fit brokers best are when the data is no longer necessary for its purpose, when the person withdraws consent, when the person objects under Article 21 and there are no overriding grounds (for direct marketing, there never are), and when the processing was unlawful. The EDPB guide notes two duties that extend the reach of an erasure request. If the controller passed the data to others, it must inform those recipients of the erasure unless this proves impossible or involves disproportionate effort. If it made the data public, it must take reasonable steps to tell other controllers to erase links and copies. The ICO adds that erasure must reach backup systems as well as live ones, on a timeline the organisation must explain.

The right is not absolute: freedom of expression, legal obligations, public interest and legal claims can justify keeping data. The ICO notes it covers only data held when the request arrives, not data collected later, which is one reason to pair erasure with an objection.

Article 14: brokers must tell you

When a controller obtains data from someone other than the person, Article 14 requires it to tell the person, including the source. The EDPB guide states that in indirect collection the information must be provided at the latest within one month after the data was obtained, and that this period cannot be extended. In practice this is where many people learn a broker holds their data, and the notice tells you who to write to.

Time limits and identity checks

Controllers must respond within one month of receiving a request. The EDPB guide explains that complex requests can be extended by two further months if the person is told within the first month, that requests are normally free, and that a manifestly unfounded or excessive request can be refused or charged for. If the controller has reasonable doubts about identity, for instance when the request comes from a different email address than the one on file, it may ask for additional information to confirm identity before answering. If it refuses, it must say why and tell you about your right to complain to a data protection authority.

How manual opt-outs work

Manual opt-outs are the oldest method and still the only one that reaches every people search site regardless of where you live. The FTC's consumer guidance describes the process: search for yourself, find the site's opt-out link (if there is none, search the site name with "opt out" or "remove my information"), submit, repeat on other sites, and "check periodically for new listings."

Identity verification

Most opt-out forms ask for an email address to confirm the request and a link to the profile you want removed. Some ask for more. The FTC notes that verification may be required. The safest rule is to give only what identifies the specific record: the profile URL, the name and city on it, and a contact email. Do not upload a driver's licence or passport to a people search site to remove a listing that never contained your ID number. Under the EDPB guidance, a controller should only ask for additional information when it has reasonable doubts; a request for a full ID scan to remove a public profile is disproportionate in most cases.

Relisting

The FTC is direct about the limit: "if information in public records changes, your information could reappear for sale." A new address on a voter roll or property record can create a new profile with a new URL. The old opt-out covers the old record. Your details can also appear in reports about relatives, neighbours or associates, which your own opt-out does not touch.

Suppression lists

Brokers that honour opt-outs keep a suppression record, a short entry that says "do not publish or sell this person." This is why the request you send should include every variation of your name and address you can: suppression is matched on what you give. It is also why you should not ask a broker to delete the suppression record itself.

Paid removal services as a category

Paid removal services file opt-outs on your behalf for a subscription. They can save many hours of form filling, and some send requests under state privacy laws as an authorised agent. They have the same limits as doing it yourself: they only cover the sites in their list, they cannot remove public records, and they need your personal details to work. The FTC suggests three questions before signing up: how many sites does it cover, will it give you a report of the sites it has opted you out of, and how often does it rescan and remove information that reappears. Add a fourth: what does the service itself do with the data you hand it, and does its privacy policy rule out selling or sharing it.

A free alternative now exists for California residents. DROP covers every registered broker in one request, costs nothing, and is run by the regulator. CalPrivacy states: "we will never charge you to use DROP." It does not cover people search sites that are exempt or unregistered, or the public records behind them, so a manual or paid opt-out pass still has a role.

Risks of the removal process itself

Removing data means sending data. Done carelessly, the process adds exposure.

• Over-sharing to verify. Every form you fill in is a new copy of your details. Send the minimum: profile URLs, the names and addresses that already appear, and a dedicated email address. Never send a full Social Security number or a scan of an ID document to a people search site.
• Fake removal services and look-alike sites. A cold email or text offering to remove you from "dark web lists" or data brokers, especially one asking for payment by gift card or crypto, is a scam pattern, and search ads can lead to pages that imitate a government service. Start from official pages: privacy.ca.gov for DROP (it is free), your state's registry, the broker's own privacy page.
• Your DROP ID. CalPrivacy asks you not to share it. It gives access to your request status and profile.
• Authorised agents. If you use an agent under a state privacy law, read what it will do with your data and whether it keeps it after the job ends.
• Email confirmation links. Opt-out confirmation emails are a phishing template. Open the broker's site directly where you can.
• Losing things you wanted. CalPrivacy notes deletion may mean fewer targeted ads or less personalised content. Untick any broker in DROP that you know you depend on.

Comparison: which route does what

Step by step: a removal plan that holds

This plan takes an afternoon to set up and about an hour every few months after. It works for anyone; the DROP step is for California residents.

Step 1: set up a removal email and a tracker

Use a separate email alias for every request so confirmation emails, broker replies and any spam that follows stay in one place. Our guide to replacing Gmail with a private email on a custom domain covers aliases in detail.

Keep a simple tracker. A CSV is enough:

date_sent,route,broker_or_site,what_sent,reference,status,next_check
2026-10-24,DROP,all registered brokers,"name,dob,zip,2 emails,1 phone,MAID",DROP-ID-stored-in-password-manager,Pending,2026-11-30
2026-10-24,opt-out,people-search-site-A,"profile URL,alias email",confirmation email,Submitted,2026-11-24
2026-10-24,GDPR Art 21+17,marketing-broker-B,"name,email",letter 2026-10-24,Sent,2026-11-24

Store the DROP ID in your password manager, not in the CSV, since CalPrivacy asks you not to share it.

Step 2: inventory where you appear

1. Search your full name with your city, then each phone number and each past address, in two different search engines. Note every people search profile URL.
2. Search each email address you use publicly.
3. Read the registries. California's registry has a download button for the full registration CSV; Oregon publishes opt-out narratives; Texas has a searchable list.
4. If you live in the EU or UK, look through Article 14 notices you have received and through the privacy notices of companies that market to you. They must name their sources.

To work through the California registry download, open the CSV and filter it rather than reading 600 rows by eye. The column names change between years, so print them first:

# Inspect the header of the downloaded California registry CSV
head -1 ~/Downloads/data-broker-registry.csv | tr ',' '\n' | nl

# Find brokers whose registration mentions a keyword, for example "geolocation"
python3 -c '
import csv, sys
path, word = sys.argv[1], sys.argv[2].lower()
with open(path, newline="", encoding="utf-8-sig") as f:
    rows = list(csv.reader(f))
head, body = rows[0], rows[1:]
for r in body:
    if any(word in c.lower() for c in r):
        print(r[0])
' ~/Downloads/data-broker-registry.csv geolocation

Adjust the path to your download. The aim is a short list of brokers in the categories that worry you most, so you know whose DROP status to watch.

Step 3: file a DROP request (California residents)

1. Go to privacy.ca.gov and open DROP from the menu. Do not use a search ad.
2. Verify residency through the California Identity Gateway. If it fails, request a review from the link on screen.
3. Enter name, date of birth and ZIP code. Add every email address and phone number you have used in recent years, maiden and former names, your Android MAID if you have one, connected TV IDs and VINs.
4. Review the broker list. Untick any broker you want to keep your data.
5. Submit. Save the 8-digit DROP ID in your password manager.
6. Check status after the first processing window. With processing from 1 August 2026 and up to 90 days for status updates, most statuses should have appeared by late October to November 2026.
7. For every "Opted-out" or "Record not found" where you expected data, add identifiers.

Step 4: opt out of the people search sites you found

For each URL from step 2: open the site's privacy or opt-out page, submit the profile URL with your alias email, confirm by email, and note the date. If a site asks for an ID document, stop and consider whether the listing is worth it; many sites accept a profile URL and email confirmation alone.

Step 5: send state law requests (outside California)

If your state has a comprehensive privacy law, send each broker you identified a request to delete and to opt out of sale and targeted advertising. A template:

Subject: Request to delete and opt out of sale: [Full name]

To the privacy team at [Broker name],

Under [state privacy law], I request that you:
1. Delete the personal information you hold about me.
2. Stop selling or sharing my personal information, and stop using it
   for targeted advertising or profiling.
3. Confirm in writing when you have done so.

To find my records, please match on:
- Name(s): [full name; former names]
- Email: [the alias you are using for this request]
- City and state: [city, state]

I am not providing additional identifiers. If you cannot match me on this
information, please treat this as an opt-out of sale for any record
that may relate to me, and keep a suppression record so I am not
re-added.

[Full name]
[Date]

California residents can use the same template for brokers outside DROP and for the first-party data that DROP does not cover, citing the CCPA.

Step 6: send GDPR requests (EU and UK)

For each controller you identified, send one letter that objects and asks for erasure. Objection comes first, because it is absolute for direct marketing.

Subject: Objection under Article 21 and erasure under Article 17 GDPR

To the Data Protection Officer at [Controller name],

1. Under Article 21(2) and (3) GDPR, I object to the processing of my
   personal data for direct marketing purposes, including profiling
   related to direct marketing.
2. Under Article 21(1), I object to any other processing based on
   legitimate interests.
3. Under Article 17(1)(c), please erase my personal data, and under
   Article 19 inform every recipient to whom you have disclosed it.
4. Under Article 15, please tell me the source of my data and the
   recipients it was disclosed to.
5. Please keep only the minimum suppression record needed to honour
   this objection.

To identify me: [full name], [email alias], [city, country].

Please reply within one month as required by Article 12(3).

[Full name]
[Date]

If there is no reply within a month, or the reply is a refusal you think is wrong, you can complain to your data protection authority (in the UK, the ICO).

Step 7: close the sources

Removal without source control is a treadmill. Reset or delete your Android advertising ID from the Ads settings. On iPhone, keep "Allow Apps to Request to Track" off. Review app location permissions and remove apps you no longer use. Turn on Global Privacy Control in a browser that supports it, so sites receive an opt-out of sale with every request (see our GPC explainer). Reduce how identifiable your browser is (see browser fingerprinting explained). Use a different email alias for each new account, so a broker that buys one list cannot join it to the others.

Step 8: re-check on a schedule

DROP re-runs itself every 45 days. People search sites do not. Put a recurring reminder in your calendar. On a Mac or Linux machine, this writes a calendar file with a reminder every 90 days that you can import into any calendar app:

cat > broker-recheck.ics <<'EOF'
BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//personal//broker-recheck//EN
BEGIN:VEVENT
UID:broker-recheck-1@local
DTSTART;VALUE=DATE:20270124
RRULE:FREQ=DAILY;INTERVAL=90
SUMMARY:Re-check data broker listings
DESCRIPTION:Search name, phones, past addresses. Check DROP status. Update tracker.
END:VEVENT
END:VCALENDAR
EOF

At each check, repeat the searches from step 2, file new opt-outs for any new URLs, and look at the DROP status page for changes. After a move, a name change or a new phone number, add the new details to DROP straight away.

Common mistakes

• Treating DROP as a people search tool. DROP reaches registered brokers. Many profiles that strangers find are built from public records, which brokers may keep and which stay on government sites regardless. Run a manual opt-out pass as well.
• Submitting only the three required fields. Name, date of birth and ZIP code are enough to file but not always enough to match. Add emails, phone numbers and a MAID to turn "Opted-out" into "Deleted".
• Sharing your DROP ID. It unlocks your status and profile. Keep it in a password manager.
• Uploading ID documents to people search sites. An ID scan creates a new, more sensitive copy of your data.
• Expecting a one-time fix from manual opt-outs. The FTC warns that changed public records can put you back on sale. Schedule re-checks.
• Asking for the suppression record to be deleted. The suppression entry is what keeps you off the next list. Erasure plus objection, not erasure alone.
• Ignoring the sources. As long as apps send your advertising ID and location to third parties, new records will appear.

FAQ

Is DROP free?

Yes. CalPrivacy states that it will never charge you to use DROP. Brokers pay registration and access fees, not consumers.

Can I use DROP if I do not live in California?

No. DROP is limited to California residents, including people domiciled in California who are temporarily away. Residents of other states can use their own state's privacy law, where one exists, and manual opt-outs. People in the EU and UK can use GDPR rights.

How long does DROP take to work?

Brokers had to start processing on 1 August 2026. They must access DROP at least every 45 days and have up to 90 days to report a status. CalPrivacy expected every broker in DROP to have completed its first cycle by November 2026.

Why does DROP say "Opted-out" instead of "Deleted"?

The broker could not make an exact match on what you submitted. It must stop selling or sharing your data but still holds it. Add more identifiers, such as additional email addresses, phone numbers or a mobile advertising ID, to make a match and a deletion possible.

Will deleting my data from brokers stop spam calls?

It can reduce them over time, but results vary. CalPrivacy says limiting data sales "can reduce the volume of unwanted texts, calls, or emails," and that results may take time to notice. Numbers already on old lists can keep circulating.

Do data removal services actually work?

They file the opt-outs you could file yourself, on the sites they choose, and some rescan. They cannot remove public records, and relisting still happens. Judge one by coverage, reporting, rescan frequency and its own data practices.

Can a people search site require my driver's licence to remove my listing?

It may ask, but you rarely need to send it. Under GDPR, a controller should only ask for more information if it has reasonable doubts about your identity. In the US, offer the profile URL and an email confirmation first, and decline to send ID documents if the listing did not contain that data.

What is the difference between the right to erasure and the right to object under GDPR?

Erasure (Article 17) removes data in defined circumstances and has exceptions. Objection (Article 21) stops processing; for direct marketing it is absolute, with no grounds to refuse. Brokers usually keep a minimal suppression record after an objection, which is what stops you being added again.

Does PADFA let me delete my data?

No. The Protecting Americans' Data from Foreign Adversaries Act bans brokers from making sensitive data of US individuals available to foreign adversary countries (China, Iran, North Korea and Russia) or companies they control. The FTC enforces it. It creates no individual deletion right.

Where Safeguard fits

Safeguard does not remove personal data, file opt-outs, monitor people search sites or track brokers, and nothing in the consumer steps above depends on it. The honest fit is on the other side of the data flow. Much of what location and marketing brokers trade starts in software: advertising, analytics and location SDKs embedded in mobile apps and websites. If you build apps, those SDKs are dependencies like any other, and you cannot govern what you have not inventoried. Safeguard scans repositories, container images and SBOM files and builds an inventory of the components in each project, so a privacy or legal review can see which third-party SDKs and versions actually ship, and Safeguard matches those components against vulnerability databases. It does not analyse where an SDK sends data or whether a vendor sells it; that still needs the SDK vendor's documentation and your own network testing.

Fix it without waiting for upstream

Data broker exposure is mostly a policy and process problem, but the apps and sites that feed brokers are built from open source and third-party components, and those components carry vulnerabilities that need the same patch discipline as anything else you ship. The fit with personal data removal is indirect; the fork and patch route described below is early access.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo sets up the local runner on your own machine, approves it with a device code and then scans from the terminal. For an app team preparing a privacy review, the same scan produces the component inventory that shows which advertising and analytics SDKs a build actually contains, without sending source anywhere first.

Click through it at your own pace, or open it full screen.

The second demo is a real Safeguard CLI session. It asks the assistant to fix a lodash CVE in a repository, reads the finding and advisory, asks before each command, edits package.json to a fixed version, and runs npm install and npm test with approval, pushing nothing. The same flow applies when a scan shows an outdated analytics or consent library in your app or website: you ask for the upgrade and approve each step.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. It helps when you want to ask an assistant which of your projects include a given SDK or library version while you work through a data inventory.

Click through it at your own pace, or open it full screen.

To try it on your own projects, download Safeguard and follow the CLI documentation.

Quick check

Sources

• CalPrivacy: Delete Request and Opt-out Platform (DROP)
• CalPrivacy: How DROP works
• CalPrivacy: Personal information and data brokers
• CalPrivacy: About DROP and the Delete Act
• CalPrivacy: Unique identifiers
• CalPrivacy: Help with DROP
• California Privacy Protection Agency: Data brokers and DROP requirements
• California Privacy Protection Agency: California Data Broker Registry
• California Privacy Protection Agency: Enforcement Advisory No. 2025-01, Data broker registration
• California Privacy Protection Agency: Announcements
• Oregon Division of Financial Regulation: Data Broker registry
• Texas Secretary of State: Data Brokers
• Public Law 118-50, Division I: Protecting Americans' Data from Foreign Adversaries Act of 2024 (govinfo)
• FTC: PADFAA warning letter template, 9 February 2026
• FTC: FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data (14 January 2025)
• FTC Consumer Advice: What To Know About People Search Sites That Sell Your Information
• Federal Register: CFPB, Protecting Americans From Harmful Data Broker Practices (Regulation V), proposed rule, 13 December 2024
• Federal Register: CFPB, Withdrawal of Proposed Rule, 15 May 2025
• EDPB: Data protection guide for small business, Respect individuals' rights
• ICO: Right to erasure
• ICO: Right to object
• Regulation (EU) 2016/679 (GDPR), official text on EUR-Lex
• GDPR Article 17 text (unofficial reproduction, used to check wording)

Related reading: the FTC data broker rule and supply chain implications, Global Privacy Control and CCPA opt-out signals, replacing Gmail with private email and custom domains and browser fingerprinting explained.

Last reviewed: 24 October 2026. Data broker laws and DROP processing are changing quickly; check the linked regulator pages for the current rules in your state or country.