The short answer
Most consumers don't have a fixed deadline to submit a data broker opt-out. You can usually act when you find a profile or decide you no longer want a broker to sell or display your information.
The deadline that matters is the broker's. In California, a verifiable deletion request normally requires a response within 45 days. A business may take an extension when it gives the required notice, and a response isn't proof that every copy has been erased.
California's Delete Request and Opt-out Platform, called DROP, adds a 2026 processing schedule. DROP opened for requests on January 1, 2026. Beginning August 1, 2026, data brokers must process DROP deletion requests at least once every 45 days. That is a recurring broker duty, not instant removal.
Deadline snapshot
| Situation | Relevant timeline | Practical meaning |
|---|---|---|
| People-search site opt-out or removal | No universal U.S. deadline | The site's policy and verification steps control timing |
| California CCPA deletion request | Usually 45 days to respond | A disclosed extension may apply |
| California DROP deletion request | Brokers must process requests at least every 45 days starting August 1, 2026 | This sets the broker's processing rhythm |
| California sale or sharing opt-out | No general annual renewal rule | A business must wait at least 12 months before asking you to opt back in |
| Requests outside California | Varies | State law and the broker's current policy control |
The 45-day number is easy to misread. It doesn't give you 45 days to act. It tells you how long the business may have after it receives a request.
California has separate clocks
CCPA and CPRA requests
California residents may have separate rights to opt out of the sale or sharing of personal information, request deletion, or use a browser-based Global Privacy Control signal for certain sale or sharing opt-outs.
The California Attorney General's CCPA guidance explains these rights and the rule that a business must wait at least 12 months before asking you to opt back in to the sale or sharing of personal information.
That 12-month rule is not an expiration date. It limits when the business can seek permission again. It also doesn't automatically cover a new profile created by another broker.
Before completing deletion, a business may need to verify your identity. It may also retain information covered by a legal exception. A confirmation showing the outcome is more useful than assuming every record disappeared.
DROP deletion requests
The California DROP platform is a state-operated system for California residents to submit deletion requests to covered data brokers. You must verify California residency before submitting. If the automatic residency check doesn't work, the platform provides a review route.
Starting August 1, 2026, data brokers must process DROP deletion requests at least once every 45 days. The schedule creates a recurring check against broker records.
DROP doesn't erase the whole internet. It doesn't remove underlying public records, information on unrelated websites, or copies held by brokers outside the platform's scope. Matching problems and legal exceptions can also affect the outcome.
Outside California
No single timetable applies to every U.S. data broker. Some state privacy laws provide deletion or opt-out rights, but eligibility and response deadlines vary.
Don't assume California's 45-day CCPA period controls a broker in another state. Check the broker's current privacy or opt-out policy first, then look for a separate right or complaint route in your state.
The result depends on the request type
Brokers use opt-out, suppression, and deletion differently. Read the confirmation closely.
| Request type | Usually changes | What it may not change |
|---|---|---|
| Sale or sharing opt-out | Tells the business not to sell or share covered information | The business may still retain the information |
| Suppression or listing removal | Hides a profile from public search or reports | The record may remain internally or return later |
| Deletion request | Asks the business to erase personal information it holds | Legal exceptions, public records, and copies held elsewhere |
An opt-out can be complete even if a profile remains in internal systems. Deletion from one broker also doesn't remove the same address, phone number, or relative connection from another broker.
The Federal Trade Commission's guidance on people-search sites recommends repeating the process on other sites. It also warns that your information may still appear in reports about relatives, neighbors, or associates.
Do Acxiom, Spokeo, and Intelius opt-outs expire?
No industry-wide expiration schedule covers Acxiom, Spokeo, Intelius, BeenVerified, Whitepages, LexisNexis, or similar brokers. Company processes differ, and forms can change.
Claims such as "Acxiom opt-outs last five years" or "Spokeo and Intelius require annual renewal" shouldn't be treated as legal rules. Use the current company form and confirmation notice. If the notice gives an expiration or re-verification date, calendar it. If it doesn't, keep the confirmation and periodically check whether your information returned.
Reappearance can have several explanations: a new data source, a changed address, or a failed match to your earlier request. It doesn't always mean the broker ignored you.
How to submit and keep track
- Copy the listing. Save the profile URL, displayed name, phone numbers, old addresses, and any record or confirmation number. These details help the broker match the request.
- Pick the right request. Use a sale or sharing opt-out to limit commercial use. Choose deletion when the law or site offers it and you want stored information removed.
- Submit through the official channel. Look for the site's privacy, opt-out, or "remove my information" page. If you can't find one, the FTC suggests searching the site name with phrases such as "opt out" or "remove my information."
- Verify only what's necessary. Use the broker's official website. Avoid sending more sensitive information than the instructions require, and don't email identity documents to an unverified address.
- Keep evidence. Save the submission date, confirmation email, screenshots, request number, and a copy of the policy shown when you submitted.
- Calendar the follow-up. For a California deletion request, follow up around the 45-day response deadline. If the business properly gives an extension, track the revised date. For DROP, remember that the 45-day period describes the broker's processing cycle.
- Test the result. Search the broker while logged out and open the original profile URL. A missing search result is helpful evidence, but it isn't proof that every copy was deleted.
- Repeat where needed. Submit separate requests to other people-search sites and brokers. Use Global Privacy Control where supported for an ongoing California sale or sharing signal, but don't assume that signal deletes an existing profile.
If the broker misses the deadline
Send a written follow-up through the broker's privacy contact. Include:
- The date you submitted the request
- The confirmation or case number
- The profile URL and matching information
- Whether you requested suppression, an opt-out, or deletion
- The response deadline you believe applies
Ask the broker to classify the request: completed, denied, delayed for verification, or no record found. If it was denied, ask which information was retained and why. Keep the reply with your original evidence.
For a California request, review the California Attorney General's CCPA information and the DROP platform. For a request outside California, check your state's privacy regulator or attorney general instead of assuming California's deadline applies.
Quick deadline answers
Is there a deadline to opt out of a data broker?
Usually not. You can generally submit when you find a listing or decide to limit the broker's use of your information. The broker's response timeline is separate from your ability to submit.
Does a California opt-out expire after one year?
No general annual expiration rule applies. California's 12-month rule limits when a business may ask you to opt back in. A broker may still require new verification or a new request if it creates a separate profile or can't match your earlier submission.
Does the California 45-day rule guarantee deletion?
No. It generally sets the response period for a verifiable CCPA request, with a possible extension when properly disclosed. The response may say information was deleted, an exception applies, or no matching record was found.
Will DROP remove my information from every data broker?
No. DROP sends deletion requests within its covered data broker system. It doesn't erase public records, information held by unrelated websites, or copies maintained outside that system.
The first move is simple: save the exact profile URL, then submit through the broker's official privacy or opt-out channel. The URL and confirmation date create the evidence you'll need if a deadline becomes an issue.