Data Broker Opt-Out Rights Under State Privacy Laws
What Is It?
Data brokers are companies that collect and sell your personal information — your name, address, phone number, email, purchasing habits, income estimates, political affiliations, and more — often without your knowledge or consent. A growing number of states now give you the legal right to demand these companies delete your data and stop selling it. California’s Delete Act (SB 362) even created a single portal to opt out of every registered data broker at once.
How It Works
- Identify data brokers that have your information. Major brokers include Spokeo, WhitePages, BeenVerified, Intelius, Acxiom, LexisNexis (for non-FCRA data), and PeopleFinder. There are hundreds of others.
- Submit opt-out requests. Each broker has a process (required by law in states with data broker regulations). This typically involves:
- Visiting the broker’s website and finding their opt-out or privacy page
- Submitting a request with enough identifying information for them to locate your records
- Verifying your identity (usually via email confirmation)
- Use California’s centralized opt-out (if eligible). Under SB 362, the California Privacy Protection Agency was directed to create a single deletion mechanism. California residents can submit one request that applies to all registered data brokers in the state. As of 2024, the CPPA launched the Delete Request portal.
- Repeat periodically. Brokers often re-collect your data from public records, social media, and commercial sources. Opting out may need to be repeated every 6-12 months unless the state law requires the broker to honor a permanent opt-out.
What Most People Don’t Know
- Data brokers are legally required to register in some states. Vermont (9 V.S.A. § 2446) and California (Cal. Civ. Code § 1798.99.80) require data brokers to register with the state. These registries are public, giving you a list of every company that buys and sells personal data.
- You can opt out even in states without specific data broker laws. The California Consumer Privacy Act (CCPA/CPRA) gives California residents the right to opt out of the “sale” of personal information from any business, not just registered data brokers. Many companies extend these rights nationwide to simplify compliance.
- The information they have is often shockingly detailed. Brokers may have your estimated income, net worth, health conditions (inferred from purchases), political leanings, relationship status, and even the names and ages of your children.
- “People search” sites are data brokers. Sites like Spokeo, TruePeopleSearch, and FastPeopleSearch that let anyone look you up are data brokers, and you can demand they remove your profile.
- Oregon’s law (effective 2024) added strong protections. The Oregon Consumer Privacy Act gives residents the right to opt out of data sales and profiling, with enforcement by the state attorney general.
Who Benefits Most?
Anyone concerned about privacy, stalking, identity theft, or unwanted contact. Especially valuable for domestic violence survivors, public-facing professionals, and anyone who has searched their own name and been alarmed by how much information appears online.
Legal Basis
- California Delete Act (SB 362, 2023) — Cal. Civ. Code § 1798.99.86, requiring the CPPA to create a centralized data broker deletion mechanism.
- California Consumer Privacy Act (CCPA/CPRA) — Cal. Civ. Code § 1798.100 et seq., granting consumers the right to know, delete, and opt out of the sale of personal information.
- Vermont Data Broker Law — 9 V.S.A. § 2446-2447, requiring data brokers to register with the state and allowing consumers to opt out.
- Oregon Consumer Privacy Act (SB 619, 2023) — ORS § 646A.570 et seq.
- Texas Data Privacy and Security Act (HB 4, 2023) — Tex. Bus. & Com. Code § 541.001 et seq.