Getting off data broker lists: what each source says

What a data broker is, and where the entry comes from

CalPrivacy, the California agency that runs DROP, describes a data broker as a business that gathers and sells consumer information that the consumer did not give it directly. Its page lists what is collected and sold: Social Security numbers, precise geolocation, browsing history, email addresses, phone numbers, interests, health-related information and shopping habits. It adds that some brokers can infer political views, health history, family details and financial status, and that these inferences count as personal information subject to deletion. Among the buyers it names are advertisers and marketers, employers and recruiters, political campaigns, retail companies, landlords and debt collectors, and it says brokers may also sell to buyers with malicious intent, such as hate groups, hostile foreign governments and scammers.

On where the data comes from, CalPrivacy says brokers often collect from businesses you deal with directly: a music service may hold your playlists, a grocery store, a clothing retailer or an app your purchases, a video service your viewing history. Information you give a business yourself, for example when you sign up for a subscription, is not covered by a DROP request, but it is covered if a broker then bought it. The National Cybersecurity Alliance, in an article dated 20 January 2026, says brokers generally fall into two categories: people-search brokers, which focus on contact details, addresses and public records, and marketing or analytics brokers. It adds that many do both, and lists property ownership, criminal history, bankruptcy filings and voter registration among the public records. The Record describes people-search sites as collecting from social media platforms, public records and commercial sources, and says the product can be bought by anybody “without any oversight”. Marketplace names Whitepages, PeopleFinders and Intelius as sites anyone can buy from.

On the law, the sources agree about the federal level and differ on the details. The National Cybersecurity Alliance says broker activity in the United States is generally legal because there is no single federal privacy law restricting it. EPIC writes that there is no federal law that adequately regulates the industry, and Privacy Rights Clearinghouse says businesses do not need your consent to collect or sell your information. On state registries, EPIC and CalPrivacy name four states that require brokers to register: Vermont, California, Texas and Oregon. EPIC dates Vermont’s law to 2018, California’s to the following year, and Texas and Oregon to 2023. The National Cybersecurity Alliance names California, Colorado and Vermont as states that require registration or extra privacy rules. The pages do not reconcile the two lists, so we give each as the page states it. EPIC also describes the harm: it says the industry gives abusers a tool to locate survivors of domestic violence, and that criminals use accurate personal details to make phishing messages more convincing.

The California route: one request through DROP

DROP is the Delete Request and Opt-out Platform, run by the California Privacy Protection Agency, which calls itself CalPrivacy. Privacy Rights Clearinghouse says it launched on 1 January 2026 as a free service that lets you send a single deletion request to every registered data broker in California. CalPrivacy says brokers began processing requests in August 2026, and that until 1 August the status of a request showed as Pending. The eligibility rule is residency: CalPrivacy says you qualify if you live in California, or if you are domiciled there but outside it for a temporary or transitory purpose. It checks residency through the California Identity Gateway, which it says confirms residency without creating an account or storing your personal information.

The minimum you must enter is a name, a date of birth and a ZIP code. Email addresses and phone numbers are on the list of what you can add, and so are a mobile advertising ID, a connected TV ID and a vehicle identification number. CalPrivacy says the more you enter, the more likely your data will be deleted, and that you can return to add more. Privacy Rights Clearinghouse explains the advertising ID: on iPhones it is the IDFA, on Android the GAID or AAID. It says many brokers hold records tied to that ID without knowing a name, email or phone number, so a request made with only the usual identifiers would not match them, and that Apple does not display the IDFA in Settings. CalPrivacy’s press release of 2 June 2026 says the whole process takes less than 10 minutes.

CalPrivacy and Privacy Rights Clearinghouse both describe hashing. CalPrivacy shows an example in which an email address you enter reaches brokers only as a hashed string, so they can match data without seeing the original. Privacy Rights Clearinghouse adds that CalPrivacy’s regulations require brokers to format fields in set ways before hashing, with dates as eight digits and phone numbers as the last ten digits, which it says removes the excuse that the details submitted do not match a broker’s records.

After you submit, you receive an 8-digit DROP ID that you use to check the status and that CalPrivacy says not to share. Brokers have up to 90 days to report how they processed the request, and after the first pass CalPrivacy says they must re-check and delete new matching data at least every 45 days. It describes DROP as ongoing rather than a one-time action. If a broker finds no match, CalPrivacy says it must still keep the request, so you do not have to submit it again. Inside the platform you can leave out particular brokers by unchecking their box in the Delete data column and selecting Update list.

The statuses, which the second figure sets out, are Deleted, Exempted, Opted-out, Record not found and Pending. CalPrivacy says some data is not deleted: what you gave a business directly, exempted data and publicly available data. Its examples of exemptions are public records such as vehicle or real estate ownership and voting records, patient health information covered by HIPAA, information that affects a credit score under the Fair Credit Reporting Act, and financial information under the Gramm-Leach-Bliley Act. Where a broker also collected data from you directly, CalPrivacy says you can still ask it to delete that data through a privacy request.

On scale, CalPrivacy’s release of 2 June 2026 says hundreds of thousands of Californians had signed up in the five months since launch, that DROP reaches more than 580 data brokers, and that the registry then held 581 registered brokers. A separate CalPrivacy page says over 600 data brokers. The two counts differ and we cite the one with the date. CalPrivacy gives the fines as $200 a day for failing to register and $200 a day per consumer for failing to delete. The pages we read do not report how many records were deleted after brokers began processing.

Outside California: one broker at a time

Privacy Rights Clearinghouse says DROP is limited to verified California residents under state law. It says Vermont, Texas and Oregon have registration requirements but no central deletion mechanism like DROP, and that the other registries are useful for transparency but do not give consumers the same tools to act. For people outside California, or anyone who prefers to act directly, it gives four steps: visit each broker’s privacy policy, submit a formal deletion request through the process it provides, often under a heading such as “Privacy Requests”, verify your identity, which may need further personal information, and wait for a response. It says a response generally comes within 45 days, though brokers may ask for extensions or deny requests for reasons the law allows. It also suggests an authorized agent service as an option where DROP is not available.

The National Cybersecurity Alliance describes the same route with a warning about its size. Many brokers provide opt-out forms on their websites, it says, but you must go to each one and there are hundreds. It says the effort takes time but is currently “the most direct way” to remove your information from major databases. It names four paid services, Incogni, DeleteMe, Aura and Optery, and points readers to guides from Consumer Reports or Tom’s Guide for recommendations. That is a list of names, not an evaluation, and the article does not rank them.

Finding the brokers is a step of its own. Privacy Rights Clearinghouse says you can check whether a company is a registered broker in the registries of California, Texas, Oregon or Vermont, or in its own database, which it says collects the state registries in one place and links to the privacy policies of nearly every broker listed. It adds that there are many brokers that are not registered.

The Consumer Reports test, as Marketplace reports it, included a group that opted out by hand. Yael Grauer of Consumer Reports calls that a time-consuming and frustrating process and says the group had slightly more data removed, and removed more quickly. The Record says four participants were in that group, so it is a small comparison, and we do not draw a rule from it.

Some of the advice is about taking in less in the first place. The National Cybersecurity Alliance says to post less personal information publicly on social media, to skip online quizzes, to give apps only the permissions they need, to review location, ad personalization and sharing settings, to use a separate email address for shopping and sign-ups, and to delete old accounts. Privacy Rights Clearinghouse adds opting out of tracking cookies, using ad blockers, enabling device privacy settings and using the Global Privacy Control browser signal. The National Cybersecurity Alliance says you cannot eliminate data brokers, only reduce what they collect, store and share.

Why an entry can come back

The Record reports that many volunteers who tried to opt out manually from some of the data removal services found the process frequently ineffective, and that data was often deleted only to “pop back up” weeks or months later. Marketplace describes the same loop as whack-a-mole: you contact each site, then double-check that it complied, then check again that your details are not reappearing.

Privacy Rights Clearinghouse gives reasons that are about law rather than effort. It says the right to delete under the California Consumer Privacy Act covers information collected from you, while brokers collect about you from other sources, which it says has let them argue that the right does not apply. It says the Act gives businesses 45 days to respond, extendable to 90, and that once information is deleted nothing stops a broker from collecting it again the next day, because an ordinary request is a one-time action. Under DROP, it says, brokers must keep the hashed identifiers on a suppression list and check newly collected data against it every 45 days, and the Delete Act bars them from selling or sharing new personal information about people who have submitted requests. CalPrivacy’s release says brokers will delete what they hold and also what they acquire moving forward. Privacy Rights Clearinghouse says it has advocated for data broker regulation for decades.

Its view of paid services is that they are private companies with no enforcement power, so that if a broker ignores them their only recourse is to try again, whereas DROP is run by a state agency that can impose fines. That comparison is Privacy Rights Clearinghouse’s, and the pages we read do not test DROP against a paid service. Grauer, in the Marketplace interview, says that if you pay for a service you should expect that it may not opt you out of everything, and should check what is still out there. One approach Grauer describes is to remove yourself by hand and also sign up for a service, or to reach out to the service to say your information is still listed, in the hope that it will redo the removal.

What paid services did in the one study we read

The Record reported on 8 August 2024 on a Consumer Reports study of 13 services that say they will strip information from people-search sites, priced from $19.99 to $249 a year. It ran four months with 32 volunteers. Consumer Reports found 332 entries for the 28 participants assigned to services, leaving out the four who opted out by hand, and 117 of them, or 35%, were taken down within four months. Marketplace, on 9 October 2024, adds that the volunteers came from the Consumer Reports Community Reports project, that Consumer Reports worked with the digital safety company Tall Poppy, and that the test looked at 13 of the most invasive people-search sites. The figure below sets the main numbers side by side.

Consumer Reports checked at one week, one month and four months, and The Record says that in all cases some data remained. On performance, it says EasyOptOuts and Optery did best, DeleteMe, IDX and Kanary were mid-level, and Confidently and ReputationDefender were the least effective. EasyOptOuts was also the cheapest. The Record gives its price as $19.99 a year, while Grauer says $19.95 in the Marketplace interview, so the pages differ by a few cents and we use the written figure. The Record adds that some services can reach $5,000 a year according to Consumer Reports, though none at that price was tested. Marketplace says ReputationDefender, at upward of $1,000 a year, told Consumer Reports its service is more comprehensive than the $100 service that was also evaluated, and that Confidently said it planned to update its service.

Half of the volunteers lived in California, The Record says, because Consumer Reports wanted to see whether the state’s privacy laws affected results, and they were compared with an equal number in New York. The Record reports that 6% more of the New York volunteers saw their data removed within four months, and notes that New York has no privacy law. We report the figure as the page gives it and add no explanation.

Grauer names limits in the Marketplace interview: the evaluation did not give the services every piece of information they asked for, and a site may rate-limit a service that automates removal. The Record says Consumer Reports found financial partnerships between people-search sites and removal services, with some services advertising or partnering with the sites. The study is from 2024, and the pages we read do not say whether the services have changed since.

What we did not use

We tested nothing: we sent no request to DROP and none to any broker. We read The Record’s and Marketplace’s accounts of the Consumer Reports study, not the study itself. We did not use Wikipedia, a Reddit thread or a university page. The pages we read do not say how long an opt-out takes at a single broker, and Privacy Rights Clearinghouse says it expects other states to look at the Delete Act as a model, while the pages do not say whether DROP will be extended. We left out the question of how a business becomes a broker beyond what CalPrivacy states: brokers register every year, process DROP requests, report what they collect and share, and undergo audits.