California residents now have a single request that reaches every registered data broker. Everyone else is opting out one site at a time. What works, in priority order, and what no removal service can do.
You cannot delete yourself from the internet. You can, with a few hours of work and a recurring reminder, get your name, address, phone number, relatives and approximate income off most of the sites that sell it. The work splits cleanly in two: if you live in California there is now a single government-run request that reaches every registered data broker at once, and if you do not, you are opting out one company at a time.
That asymmetry is the central fact of this subject in 2026. There is no federal right to make a data broker delete you. The Consumer Financial Protection Bureau proposed a rule that would have brought many data brokers under the Fair Credit Reporting Act, and withdrew it on May 15, 2025, stating in the Federal Register notice that legislative rulemaking was not necessary or appropriate at that time. What exists instead is a patchwork of state law, and California’s is the one with real teeth.
What a data broker actually holds
Two different industries get called data brokers, and they need different treatment.
People-search sites assemble public records into a profile with your name on it: property deeds, voter registration, court filings, marriage and divorce records, licence records, old phone directories, and whatever social platforms leaked or sold along the way. The output is a page a stranger can read, showing your address history, age, phone numbers and the names of your relatives. These are the ones that matter for personal safety and for social engineering, and they are the ones you can meaningfully clean up.
Advertising and location data brokers deal in device identifiers and movement patterns rather than named profiles. The Federal Trade Commission’s action against Kochava, settled under a proposed order announced on May 4, 2026, concerned precise location data from hundreds of millions of mobile devices, which the agency alleged could reveal visits to sensitive locations including health facilities and places of worship. You will not find a page with your name on it at a company like this, and you cannot usually opt out by name. You limit it at the device, not at the broker.
Both industries feed the same downstream problem. The Federal Trade Commission reported on June 15, 2026 that about 16 billion dollars was reported lost to fraud in 2025, the highest on record, with 3.5 billion dollars of that going to imposter scams. Imposter scams run on specifics: a caller who knows your address, your mortgage lender and your daughter’s name is far more convincing than one who does not. Those specifics are, for a few dollars, for sale.
If you live in California: use DROP first
California’s Delete Act, Senate Bill 362, required the California Privacy Protection Agency to build a single mechanism through which one verifiable request directs every data broker holding your personal information to delete it. The agency calls it the Delete Request and Opt-out Platform, or DROP.
The timeline matters, because the system is only now becoming fully operational:
- Consumers could begin submitting DROP requests in January 2026.
- From August 1, 2026, registered data brokers must access the mechanism and process consumer deletion requests, and must continue to check it at least once every 45 days thereafter.
- The California Privacy Protection Agency has stated a penalty of 200 dollars per day per deletion request for brokers that fail to comply.
The practical consequence is that a request submitted once propagates, on a rolling 45-day cycle, to every broker on the state’s registry, and keeps propagating to brokers that register later. That is a fundamentally different proposition from opting out of forty sites by hand. It covers only brokers that have registered with California, and it is a deletion right rather than a guarantee that nothing is ever collected again, but it is the single highest-value action available to a California resident on this subject.
The California Privacy Protection Agency also maintains a public registry of data brokers that have registered with the state. It is worth reading even if you live elsewhere, because it is the closest thing that exists to a list of who is in this business.
If you live anywhere else: the manual route, in priority order
Without a DROP equivalent, the job is to spend a finite amount of effort where it removes the most exposure. The temptation is to work alphabetically through a list of two hundred brokers. That is how people give up in week two.
A more useful approach is to search your own name plus your city, and your name plus your phone number, and deal with what actually appears on the first two pages of results. Those are the pages a stranger, an ex, or a scam caller would find. Pages nobody surfaces are a lower priority than pages everybody sees.
Then work in this order.
| Priority | What to do | Realistic effort | How long it holds |
|---|---|---|---|
| 1 | Freeze your credit at all three national credit reporting companies | About 15 minutes total, free | Until you lift it |
| 2 | Opt out of the top people-search sites that appear in a search for your own name | 15 to 30 minutes per site, mostly waiting on email confirmation | Months to a couple of years |
| 3 | Opt out of the large credit bureau marketing lists and prescreened offer lists | About 10 minutes | Five years, or permanently if you mail the form |
| 4 | Turn off the advertising identifier and tighten location permissions on every phone and tablet | About 20 minutes per device | Until a reset or a new device |
| 5 | Remove old accounts you no longer use, especially ones holding an address or phone number | An evening | Permanent, where honoured |
| 6 | Re-run the search and the opt-outs | An hour | Why this is a calendar reminder, not a project |
Note what sits at number one. A credit freeze is free, takes a quarter of an hour, and blocks the specific harm that most data broker exposure leads to, which is somebody opening an account in your name. It does nothing about your address being visible, but it is a far better return on fifteen minutes than any opt-out form. If you have not done it, freezing your credit is the thing to do before reading further.
How the opt-outs actually work, and where they stall
Most people-search opt-outs follow the same pattern. You find the removal or opt-out page, which is usually in the footer and deliberately unglamorous. You search for your own listing. You submit the specific URL of your profile, confirm by email, and wait anywhere from a few days to six weeks.
Four things reliably go wrong.
Duplicate listings. Many sites hold several records for one person, sometimes under a maiden name, a middle initial, or an old address. Removing one does not remove the others. Search again after the first removal confirms.
Network ownership. A single company often operates a dozen differently branded people-search sites off one database, and a single opt-out may or may not cover the siblings. Where a removal page lists affiliated brands, read the list.
The email verification trap. Some sites require an email address to process a removal, which means handing a data broker a fresh, verified piece of information. Use an alias or forwarding address you can discard rather than your main one, and never supply more identifying data than the form strictly requires. If a removal form asks for a government identification number, stop; no legitimate removal needs it.
Re-listing. This is the one that defeats people. Brokers rebuild profiles from the same public records on a rolling basis. A deed, a voter roll update, a new utility account or a change of address refreshes the source data, and a profile removed in March can reappear in October built from the same records. Removal is not a one-time fix; it is a maintenance task on roughly a twice-yearly cadence.
Paid removal services: what they can and cannot do
Several companies will do the opt-outs for you for a subscription. They are not a scam, and for some people they are a reasonable purchase. It is worth being precise about what you are buying.
What you are buying is labour and monitoring. The service submits the same opt-out requests you could submit, tracks which ones stuck, and resubmits when a profile reappears. That recurring resubmission is the genuine value, because it is the part people do not sustain on their own.
What you are not buying is any legal power you do not already have. A removal service has no authority a consumer lacks. It cannot compel a broker outside a state with a deletion law, it cannot reach brokers that do not offer an opt-out, and it cannot touch the advertising and location data industry, which does not deal in named profiles. Marketing claims about removing you from hundreds of sites are counting opt-out submissions, not verified deletions.
A reasonable decision rule:
- California resident: submit a DROP request, which does for free and with statutory backing most of what a paid service sells. Add a paid service only if you also want coverage of sites not on the state registry.
- Elsewhere, ordinary risk: do the manual opt-outs for the sites that surface in a search for your name, set a six-month calendar reminder, and keep the money.
- Elsewhere, elevated risk: if you are dealing with a stalker, harassment, or a profession that attracts hostility, a paid service’s continuous monitoring is worth the subscription, and should be paired with address confidentiality programmes where your state offers one. Several states run such programmes for survivors of domestic violence and stalking, and they are run through the state rather than through any company.
The device side, which most guides skip
Removing named profiles does nothing about the location and advertising data industry. That is handled at the device, and it takes about twenty minutes.
The Federal Trade Commission’s consumer guidance on app privacy recommends adjusting browser privacy settings to block sites from seeing your browsing history or location, reviewing what information apps can access from your device, and using the advertising section of your phone’s privacy settings to opt out of personalised advertising from the device maker. It also points to the industry opt-out tools run by the Digital Advertising Alliance and the Network Advertising Initiative, while being clear these address personalised advertising rather than data sales generally.
The three settings worth changing on every device you own:
- Set location permission to “while using the app” or “never” for everything that is not a map or a transport app. Background location access is the raw material of the location data industry.
- Reset and then disable the advertising identifier. It is the key that links your behaviour across unrelated apps.
- Audit app permissions you granted years ago. Contacts access is the one to revoke most aggressively, because granting it hands over other people’s data as well as your own.
While you are in there, the same twenty minutes is a good moment to deal with the account security side of this, because exposed personal data is mostly useful to an attacker as the first half of an account takeover. Moving your important accounts to passkeys removes the password that broker-sourced data helps someone guess or reset.
What to actually do, in order
- Freeze your credit at all three bureaus. Free, fifteen minutes, blocks the most common consequence.
- If you are a California resident, submit a DROP request. One verifiable request, propagating to registered brokers on a 45-day cycle, backed by a 200 dollar per day per request penalty.
- Search your own name plus city and name plus phone number. Opt out of everything on the first two pages of results, starting with whatever ranks first.
- Opt out of prescreened credit and insurance offers. A separate, short process from the credit freeze, and it reduces the paper mail that mail-theft identity fraud depends on.
- Fix the device settings. Location to while-in-use, advertising identifier off, old permissions revoked.
- Use an alias email for every removal form. Do not pay for a removal with fresh data.
- Set a calendar reminder for six months out. This is the step that distinguishes people whose profiles stay down from people who did this once in 2024.
- Treat a caller who knows your details as unverified anyway. No amount of removal work makes an unsolicited caller trustworthy, which is the whole premise behind how families beat voice cloning scams and behind spotting a phishing email.
The part worth being honest about
This is a chore with no completion state. The underlying data is mostly public records, which exist because property transfers, court proceedings and voter rolls are public by design, and that design is not going to change for privacy reasons. Brokers rebuild from those records because the records keep being generated. You are not deleting data; you are repeatedly asking a reseller to stop showing it, and the reseller’s business is showing it.
What has changed is leverage. Before the Delete Act there was no mechanism anywhere that made one request reach an entire industry. California now has one, and whether other states copy it is the thing to watch. The federal picture moved the other way in 2025, when the Consumer Financial Protection Bureau withdrew the rule that would have brought data brokers under existing credit reporting law.
So the realistic goal is not invisibility. It is raising the effort required to find you from thirty seconds to a few hours, which is enough to deter the opportunistic use that drives most of the harm, and doing the fifteen-minute credit freeze that blocks the expensive version of it. That is a modest outcome, and it is genuinely worth an afternoon and a recurring reminder.
Where these figures come from
- California Privacy Protection Agency, Delete Request and Opt-out Platform, data broker pages, 2026
- California Senate Bill 362, the Delete Act
- Consumer Financial Protection Bureau, Protecting Americans From Harmful Data Broker Practices (Regulation V); Withdrawal of Proposed Rule, Federal Register, May 15, 2025
- Federal Trade Commission, press release on the proposed Kochava order, May 4, 2026
- Federal Trade Commission, press release on 2025 imposter scam losses, June 15, 2026
- Federal Trade Commission consumer guidance, How to protect your privacy on apps
General information, current as of October 2026, and not personalised legal or privacy advice. State laws, platform dates and agency rules change quickly in this area; check the primary sources before relying on any deadline above.
