Data Broker Opt-Out Rights by State: California's Delete Act, DROP, and Other State Laws

Why state laws matter for data brokers

For most of the internet's history, getting off people-search sites depended entirely on each site's goodwill. Sites offered opt-outs, but no law required them to. That has started to change at the state level. There is no single federal law that gives every American a right to make data brokers delete their information, so where you live now affects what you can demand.

State laws generally take two forms. Some are broad consumer privacy laws that give residents rights over personal information held by many kinds of businesses. Others focus specifically on data brokers, requiring them to register with the state and, in California's case, to honor a central deletion system.

California: the Delete Act and DROP

California has gone furthest. Its Delete Act created DROP, the Delete Request and Opt-out Platform, run by the California Privacy Protection Agency.

What DROP does. DROP lets a California resident send a single request telling registered data brokers to delete their personal information and not sell it. According to the state, that one request reaches more than 600 registered data brokers. It costs nothing to use.

How it works. You verify that you are a California resident through the state's identity gateway, create a profile with basic information, and submit your request. You choose how much information to provide. More details can help brokers find your records, but you control what you share.

The timeline. DROP launched on January 1, 2026, so Californians could start submitting requests. Starting August 1, 2026, data brokers had to begin accessing DROP at least every 45 days to process deletion requests. The state says it can take up to 90 days for your status to update, and that by November 2026 all brokers in DROP should have completed their first processing cycle.

Requests for others. The state says that in some cases you can submit a request for another California resident, such as a parent for a child or a family member for an elderly relative.

What DROP does not do. DROP covers registered data brokers. It does not remove public records from government sites, news articles, social media posts, or information held by businesses that collected it directly from you as customers. It also does not remove Google search results, so pair it with Google's Results about you.

California: CCPA rights

California's Consumer Privacy Act, as amended, gives residents a set of rights over personal information that businesses hold. According to the California Attorney General, these include:

Note the wording on deletion: it covers information collected from you. Data brokers usually collect information about you from other sources, which is one reason the Delete Act and DROP were created.

• Right to know what personal information a business collects, where it came from, why it is used, and who it is shared with.
• Right to delete personal information collected from you, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing, including through a browser-based global privacy control.
• Right to limit the use of sensitive personal information.
• Right to non-discrimination for using these rights.

Other states with privacy laws

Many states have passed comprehensive consumer privacy laws in recent years, and more are added regularly. These laws commonly give residents rights to access, correct, and delete personal data and to opt out of its sale or use for targeted advertising. They differ in important ways:

Because these laws change often, the most reliable step is to check your state attorney general's website for current details.

• Who is covered. Many laws apply only to businesses above certain size or data thresholds.
• What is exempt. Publicly available information is often excluded, which can limit what you can demand from people-search sites.
• How to exercise rights. Most require you to send a request to each business. There is usually no central platform like DROP.
• Enforcement. Most are enforced by the state attorney general rather than through individual lawsuits.

States that require data brokers to register

Some states require data brokers to register with a state office. Texas, for example, requires data brokers to register with the Texas Secretary of State, which publishes information about registered brokers. Vermont and Oregon have similar registration laws, and California's list of registered brokers is the foundation of DROP.

Registration on its own does not delete anything. But a public list of brokers is a useful starting point: it tells you which companies trade in personal data and where to send requests.

How to use state rights in practice

If you live in California: Submit a DROP request first, since it reaches the most brokers at once. Then handle people-search sites that still show your information through their own opt-outs, and use Google's tool for search results. See how to remove yourself from people-search sites.

If you live in another state with a privacy law: Use each site's privacy request form and reference your state's law. Many forms have a dropdown for your state. Keep confirmation emails.

If your state has no privacy law yet: You can still use voluntary opt-outs, which most large people-search sites offer regardless of state, plus Google's removal tools. The process is the same; you just have fewer legal levers if a site refuses.

What to include in a direct request

When you send a privacy request to a business yourself, keep it short and specific. Include your full name, the email address or phone number the business may have on file, the state you live in, and exactly what you are asking for, such as deletion of your personal information and an opt-out of its sale or sharing. If the request is about a people-search listing, include the link. Do not send more identifying details than the business asks for. Most businesses must verify your identity before deleting data, but they should only ask for what is reasonably needed to match your records.

What to do if a business ignores you

If you made a valid request under your state's law and the business did not respond within the legal timeframe, you can usually file a complaint with your state attorney general. California also accepts complaints through the California Privacy Protection Agency. Keep your records: the date of your request, what you asked for, and any replies.

If the issue is serious, such as information being used to harass you, talk to a lawyer and see what to do if you are doxxed.

Do you still need a paid service?

State rights reduce the need for paid removal services, especially in California, where DROP does at no cost much of what services charge for. Services may still save time with sites that are not registered brokers. See do paid data-removal services work for an honest comparison, and our guide on how much reputation help costs for broader context.

Keep checking

Even with legal rights, new records can create new listings. Recheck every three months with the quarterly privacy recheck, and check DROP status if you used it.

Common questions

Sources

1. Delete Request and Opt-out Platform (DROP) (California Privacy Protection Agency)
2. California Consumer Privacy Act (CCPA) (California Attorney General)
3. Data Brokers (Texas Secretary of State)
4. Results about you (Google Search Help)