If a data broker has the wrong address, exposes your profile, or sells sensitive information, start by asking how the information is being used. A public people-search page usually calls for an opt-out, deletion, or correction request. A report used to decide whether you get credit, housing, employment, or insurance may require a dispute under the Fair Credit Reporting Act (FCRA).
California residents have an additional route for covered data brokers through the Delete Request and Opt-out Platform, known as DROP. Other states have different privacy laws and procedures. An FTC complaint can help regulators spot a pattern, but it generally won't correct your record or create an individual payment.
This is general consumer information, not legal advice.
Quick answer: use the route that matches the problem
- Wrong or exposed people-search profile: Save a dated copy, then use the company's official opt-out, deletion, or correction process.
- Credit, employment, tenant, insurance, or similar report: Dispute the specific inaccurate item with the consumer reporting agency. Where appropriate, also dispute it with the company that supplied the information.
- California data-broker deletion: Use California's DROP platform if you're an eligible California resident and the broker is covered by the Delete Act.
- Sensitive location or health-related information: Preserve evidence, request deletion or restriction where the applicable law provides that option, and report suspected deceptive or harmful conduct to the appropriate regulator.
- No response or repeated republication: Send a focused follow-up, keep proof of delivery, complain to the relevant agency, and consider qualified legal help if the information caused a serious loss.
There isn't one federal "data broker dispute" form. Deletion also isn't guaranteed in every situation; identity verification, legal exceptions, the source of the information, and the company's role can affect the result.
What rule controls the dispute?
The label "data broker" isn't enough to determine your rights. The key questions are what information the company has, why it has it, and whether another company used it to make a decision about you.
| Your problem | Most relevant route | Important limit |
|---|---|---|
| A people-search page shows the wrong address or relatives | The broker's privacy request, opt-out process, or applicable state privacy law | A public profile isn't automatically an FCRA consumer report |
| A report contributed to a credit, job, housing, or insurance decision | FCRA dispute with the reporting agency and, where appropriate, the furnisher | Identify the exact information that is inaccurate or incomplete |
| You want covered brokers to delete your California data | California privacy rights and DROP | DROP is limited to eligible California residents and covered data brokers |
| A company collected or sold sensitive location data | A privacy request and, when appropriate, a regulator complaint | A complaint does not guarantee individual deletion or compensation |
| You are relying on the GDPR | A GDPR request only if its territorial rules apply | Living in the United States does not automatically create a GDPR claim |
A state privacy request can be useful for a broker profile, but it isn't a substitute for an FCRA dispute when a consumer report affected a job, loan, apartment, or insurance decision. The reverse is also true: not every people-search website is covered by the FCRA.
What the public cases actually show
FTC action against Mobilewalla
In December 2024, the FTC announced action against Mobilewalla over allegations involving the collection and sale of sensitive location data. The agency said the information included visits to health clinics and places of worship, and that consumers often didn't know Mobilewalla had obtained their data. See the FTC's Mobilewalla announcement.
That is a regulatory case, not an individual correction proceeding. It can help explain why a location profile presents a privacy concern, but it doesn't show that your particular record is inaccurate or that you can claim damages.
The Federal Register analysis of the proposed Mobilewalla consent order is also useful for understanding the case's status. A proposed consent order and public comments are not the same thing as a final court judgment or an individual settlement.
FTC action involving Gravy Analytics and Venntel
The FTC announced action against Gravy Analytics and Venntel concerning the sale of location data that could track visits to sensitive places. The agency described a sensitive-location data program intended to address the use, sale, licensing, transfer, sharing, or disclosure of visits to those places. Read the FTC announcement about Gravy Analytics and Venntel.
The FTC announcement says that violating such an order may result in a civil penalty of up to $51,744 per violation. That figure isn't money an individual consumer can automatically claim. Treat the case as context for a privacy request or regulator complaint, not as proof that the broker violated the law against you.
Robins v. Spokeo
The U.S. Supreme Court case involving Thomas Robins and Spokeo concerned allegedly inaccurate information in a people-search profile and whether the alleged violation created a sufficiently concrete injury for federal-court standing. The case was sent back for further analysis.
An inaccurate profile and a successful damages lawsuit are separate issues. If a profile is wrong, document the error and request correction or deletion. If the information was used for a covered eligibility decision, examine the FCRA process instead of assuming that every profile dispute is an FCRA claim.
What these cases don't establish
Public enforcement records do not prove that:
- every data point in your profile is false;
- every broker must delete data for every U.S. resident;
- an FTC complaint will produce a refund or settlement payment;
- a people-search profile is automatically a consumer report;
- a deletion request overrides every legal, security, or fraud-prevention exception.
There is no reliable universal "success rate" for individual data-broker requests. For one consumer, a meaningful result is a written correction, confirmed deletion, corrected consumer report, or documented restriction on sale or sharing.
How to dispute a data broker
1. Save the evidence first
Capture the page or report before contacting the company. Record:
- the broker's name, website, and privacy contact;
- the profile URL or report number;
- the date and time you viewed it;
- each inaccurate or sensitive item;
- screenshots showing the information;
- the name of the employer, lender, landlord, insurer, or other requester if the data affected a decision;
- adverse-action notices, emails, confirmation numbers, and other correspondence.
Don't send original documents. If identity verification is required, use the company's verified privacy portal and provide only what is needed to locate the record. Redact unrelated account numbers, full Social Security numbers, and other information the company doesn't need.
2. Identify the company that actually holds or uses the record
A search result may display one brand while the privacy request is handled by a parent company, affiliate, or separate consumer reporting agency. Check the page's privacy notice and dispute instructions before submitting anything.
Use the official form or mailing address listed by the company. If you use email or mail, choose a method that leaves a delivery record. Certified mail can help when a physical address is provided, but it isn't automatically required for every privacy request.
If an employer, lender, landlord, insurer, or other business used a report, find the consumer reporting agency named in the report or adverse-action notice. A request sent only to the public-facing website may not start the FCRA investigation process.
3. Choose the result you want
Your goal affects the request:
- Deletion: Usually the goal when you don't want a public profile or marketing record.
- Correction: Appropriate when a report contains inaccurate or incomplete information and deletion isn't available or wouldn't solve the problem.
- Opt-out of sale or sharing: May limit particular uses without removing the underlying record.
- Restriction or suppression: May be relevant when the information creates a safety risk or involves sensitive location data, if the applicable law or company process offers that option.
If the information affected a credit, employment, housing, insurance, or similar decision, don't rely only on a general opt-out form. Begin the appropriate consumer-report dispute as well.
4. Send a specific privacy request
State exactly what is wrong or what you want removed. Include enough identifiers for the company to find the record, but don't volunteer additional sensitive information.
For a covered California privacy request, a business generally has 45 days to respond and may be able to extend the response period with notice. That deadline concerns the response process; it doesn't mean every request must be granted. Identity verification, exceptions, and the type of business can affect the result.
5. Use the FCRA process when a consumer report caused the problem
If a company used a consumer report about you for credit, employment, housing, insurance, or another covered purpose, send a written dispute to the reporting agency listed in the notice or report. Where appropriate, also dispute the information with the company that supplied it.
Identify:
- the exact item you believe is inaccurate or incomplete;
- why it is wrong;
- the correction you want;
- copies of supporting documents;
- the report date and any report, application, or case number.
A consumer reporting agency generally has 30 days to investigate, although some disputes can take up to 45 days. Use the dispute address and instructions supplied with the report rather than sending the request only to a general customer-service address.
The FCRA process concerns accuracy, completeness, and reasonable investigation. It doesn't generally give you a right to erase accurate information simply because you dislike it.
6. Use DROP if you are an eligible California resident
California residents can use the California Delete Request and Opt-out Platform to submit a deletion request to covered data brokers. The platform requires verification of California residency.
The California Privacy Protection Agency's data-broker guidance says that, beginning August 1, 2026, covered data brokers must access the deletion mechanism at least once every 45 days and process requests, subject to limited exceptions.
DROP isn't a nationwide deletion list, and it doesn't replace an FCRA correction dispute. Save the platform confirmation and review each response. If a broker says it can't comply, ask which exception or verification problem it is relying on.
7. Keep a log and check again
A simple record can prevent the dispute from becoming a series of disconnected emails.
| Date | Company | Request | Method | Confirmation | Result |
|---|---|---|---|---|---|
| March 4 | Broker name | Delete profile | Privacy form | Case number | Awaiting response |
| March 20 | Reporting agency | Correct address | Delivery receipt | Investigation pending |
Save every response. Note whether the company deleted the record, corrected it, found no matching record, or denied the request. Search again after a reasonable interval. If the information returns, ask whether it came from a particular affiliate, public source, or data supplier.
Data-broker dispute letter templates
General deletion or opt-out request
Subject: Request to delete and limit use of my personal information
Hello [company name],
I am requesting deletion of the personal information associated with:
Name: [full name]
Former names: [if relevant]
Current or former address: [address needed to identify the record]
Email or phone used for this request: [contact information]
Profile URL or record number: [URL or number]
Please delete the profile and personal information associated with these identifiers. Where applicable under the law or your privacy policy, also opt me out of the sale or sharing of my personal information.
Please confirm what action you took. If you cannot comply in whole or in part, identify the specific reason, exception, or verification problem and tell me what information is needed to complete the request.
Sincerely,
[Name]
[Date]Correction request for a people-search profile
Subject: Request to correct inaccurate personal information
Hello [company name],
The following information in profile or record [URL or number] is inaccurate:
Incorrect item: [quote the exact entry]
Correct information: [state the correct information]
Reason it is inaccurate: [brief explanation]
Please investigate and correct the record. If you cannot verify the item, please delete it where applicable. Confirm the result in writing and identify any related profile or affiliate that contains the same information.
I have attached copies of supporting documents with unrelated information redacted.
Sincerely,
[Name]
[Date]FCRA dispute template
Use this version when the report is connected to a covered consumer-reporting purpose.
Subject: Dispute of inaccurate information in consumer report
To: [consumer reporting agency or furnisher]
Report date or number: [date or number]
I dispute the following item in my consumer report:
Item: [account, address, public record, employer, or other entry]
Why it is inaccurate or incomplete: [specific explanation]
Requested correction: [remove, update, or correct the item]
I am enclosing copies of documents supporting my dispute. Please conduct a reasonable reinvestigation and send me the written result. If the item is corrected, please provide an updated report or confirmation of the correction.
Please send correspondence to:
[Name]
[Mailing address]
[Email or phone, if appropriate]
Sincerely,
[Name]
[Date]Send the dispute to the official address listed for consumer-report disputes. Keep a complete copy of everything you submit, including attachments and proof of delivery.
If the broker refuses or republishes the information
A refusal alone doesn't prove a legal violation. Common explanations include:
- the company couldn't match your identity;
- the request went to the wrong affiliate;
- the company claims a statutory, security, or fraud-prevention exception;
- the information came from another source;
- the company says it isn't a consumer reporting agency;
- the profile was removed and later republished.
Send a focused follow-up that includes the case number and asks for the specific explanation. If the problem is an identity mismatch, provide a narrowly tailored identifier through the verified channel. If the issue involves an FCRA report, use the reporting agency and furnisher dispute process instead of arguing only with the public-facing website.
For California requests, the CPPA data-broker information and the DROP platform are the relevant state resources. For suspected deceptive collection, sale of sensitive location data, or conduct affecting many people, an FTC complaint may help regulators identify a pattern. It won't replace an individual FCRA dispute or guarantee deletion.
If a false report caused a lost job, denied housing, a higher borrowing cost, or another measurable loss, consider speaking with a qualified consumer-law attorney or legal-aid organization. Keep the report, adverse-action notice, dispute, response, and delivery evidence together.
DIY requests versus removal services
DIY removal is often practical when only a few websites publish your information. You keep direct control over the evidence and over what identity information you disclose.
A removal service may save time across many sites, but it can't guarantee that every broker will comply or that information won't reappear. Before paying, check:
- which websites the service actually covers;
- whether it sends deletion requests or only monitors results;
- what identity information it retains;
- how recurring billing and cancellation work;
- how it handles requests involving consumer reports;
- whether you can obtain copies of submissions and responses.
If a credit, job, housing, or insurance decision is involved, submit the direct FCRA dispute promptly. Don't wait for a commercial removal service to decide whether the report qualifies.
Frequently asked questions
Can I cite an FTC case in my letter?
Yes. You can cite the Mobilewalla or Gravy Analytics matter to explain why sensitive location data creates a privacy concern. Don't say that the case proves your individual violation or guarantees a payment. Your letter will be stronger if it identifies your own record, the exact inaccurate or sensitive field, and the remedy you want.
Does the CCPA give every U.S. resident a deletion right?
No. California privacy rights generally depend on California residency and the applicable business and data conditions. Other states have their own laws, exemptions, and procedures. A company may offer a nationwide opt-out, but that is different from a uniform nationwide legal right.
Can a U.S. consumer use the GDPR?
Not automatically. GDPR applicability depends on its territorial rules and the facts of the processing, not simply on a broker having an international website. Confirm that the law applies before relying on a GDPR request.
Does deletion stop the data from being collected again?
Not necessarily. A broker may receive information from a permitted source, an affiliate may keep a separate record, or a profile may be republished. Ask for the source or related record when the company provides that information, save the deletion confirmation, and repeat the request if the profile returns.
What is the strongest evidence in a data-broker dispute?
The most useful evidence is a dated copy of the record, a precise explanation of what is wrong or harmful, documents supporting the correction, proof of how the information was used, and a record of each request and response. Before sending your next dispute, save the record, identify the exact field at issue, and choose the privacy or FCRA route that matches its use.