care-about-privacy

Data Broker Opt-Out Rights Under State Privacy Laws

Difficulty Easy-Intermediate Risk None Applies To California, Vermont, Texas, Oregon, and expanding Potential Savings Reduced spam, identity theft risk, and unwanted solicitations Last Verified 2026-02-10

Data Broker Opt-Out Rights Under State Privacy Laws

What Is It?

Data brokers are companies that collect and sell your personal information — your name, address, phone number, email, purchasing habits, income estimates, political affiliations, and more — often without your knowledge or consent. A growing number of states now give you the legal right to demand these companies delete your data and stop selling it. California’s Delete Act (SB 362) even created a single portal to opt out of every registered data broker at once.

How It Works

  1. Identify data brokers that have your information. Major brokers include Spokeo, WhitePages, BeenVerified, Intelius, Acxiom, LexisNexis (for non-FCRA data), and PeopleFinder. There are hundreds of others.
  2. Submit opt-out requests. Each broker has a process (required by law in states with data broker regulations). This typically involves:
    • Visiting the broker’s website and finding their opt-out or privacy page
    • Submitting a request with enough identifying information for them to locate your records
    • Verifying your identity (usually via email confirmation)
  3. Use California’s centralized opt-out (if eligible). Under SB 362, the California Privacy Protection Agency was directed to create a single deletion mechanism. California residents can submit one request that applies to all registered data brokers in the state. As of 2024, the CPPA launched the Delete Request portal.
  4. Repeat periodically. Brokers often re-collect your data from public records, social media, and commercial sources. Opting out may need to be repeated every 6-12 months unless the state law requires the broker to honor a permanent opt-out.

What Most People Don’t Know

  • Data brokers are legally required to register in some states. Vermont (9 V.S.A. § 2446) and California (Cal. Civ. Code § 1798.99.80) require data brokers to register with the state. These registries are public, giving you a list of every company that buys and sells personal data.
  • You can opt out even in states without specific data broker laws. The California Consumer Privacy Act (CCPA/CPRA) gives California residents the right to opt out of the “sale” of personal information from any business, not just registered data brokers. Many companies extend these rights nationwide to simplify compliance.
  • The information they have is often shockingly detailed. Brokers may have your estimated income, net worth, health conditions (inferred from purchases), political leanings, relationship status, and even the names and ages of your children.
  • “People search” sites are data brokers. Sites like Spokeo, TruePeopleSearch, and FastPeopleSearch that let anyone look you up are data brokers, and you can demand they remove your profile.
  • Oregon’s law (effective 2024) added strong protections. The Oregon Consumer Privacy Act gives residents the right to opt out of data sales and profiling, with enforcement by the state attorney general.

Who Benefits Most?

Anyone concerned about privacy, stalking, identity theft, or unwanted contact. Especially valuable for domestic violence survivors, public-facing professionals, and anyone who has searched their own name and been alarmed by how much information appears online.

  • California Delete Act (SB 362, 2023) — Cal. Civ. Code § 1798.99.86, requiring the CPPA to create a centralized data broker deletion mechanism.
  • California Consumer Privacy Act (CCPA/CPRA) — Cal. Civ. Code § 1798.100 et seq., granting consumers the right to know, delete, and opt out of the sale of personal information.
  • Vermont Data Broker Law — 9 V.S.A. § 2446-2447, requiring data brokers to register with the state and allowing consumers to opt out.
  • Oregon Consumer Privacy Act (SB 619, 2023) — ORS § 646A.570 et seq.
  • Texas Data Privacy and Security Act (HB 4, 2023) — Tex. Bus. & Com. Code § 541.001 et seq.

Frequently Asked Questions

Do I need to opt out of every data broker separately, or is there a single opt-out?

For most brokers, you do need to opt out individually — each has its own process. However, California residents can use the state’s DROP (Delete Request and Opt-Out Platform) at privacy.ca.gov to submit a single deletion request to all registered California data brokers at once. Non-California residents currently have no equivalent federal mechanism.

How long does it take for my information to actually be removed after I submit an opt-out?

Most brokers process requests within 10–30 days, though some may take up to 45 days. After removal, your data often reappears within 6–12 months as brokers re-collect from public records and other sources — so opt-outs need to be repeated periodically.

Can I opt out if I don’t live in California, Vermont, Oregon, or Texas?

Yes. Even without a state-specific data broker law, you can submit opt-out requests directly to each broker — they are generally required to honor them. Many companies extend CCPA-style opt-out rights to all US consumers to simplify compliance, regardless of your state.

Do people-search sites like Spokeo or WhitePages count as data brokers I can opt out of?

Yes. Spokeo, WhitePages, BeenVerified, TruePeopleSearch, and similar sites are data brokers. All of them have opt-out pages where you can request removal of your profile. Search for “[site name] opt out” to find the specific removal form.

Will opting out of data brokers stop me from receiving spam calls and junk mail?

It reduces them significantly over time, but not immediately and not entirely. Data brokers are one major source of telemarketing lists, so opting out can cut down on unsolicited contact — but some callers purchase lists before your opt-out is processed, and not all junk mail originates from registered data brokers.

Sources