If a data broker ignored your opt-out or still shows a profile you asked to delete, you can report that to a U.S. agency. You don't need a lawyer to start. You do need a paper trail.
So which office actually reads these?
Thing is, a privacy policy is not a federal right. Separate California deletion rules and federal credit-report rules exist, and stuffing both stories into one rant just slows the reviewer down. Keep the paths apart.
What these complaints are really about
Data brokers assemble names, relatives, addresses, and purchase clues, then license that bundle. A few of the same brand names also furnish consumer reports. Those jobs follow different rules.
A marketing listing that should have been deleted is a privacy problem, while a wrong late payment on a credit file is a reporting problem. Treat them as different files even if the logo looks familiar.
Agencies respond to specifics. "They have my data" is not a fact pattern. "I submitted a deletion request on April 2, got no confirmation, and the same URL still shows my phone number" is.
If a broker compiled data on a child under 13, say the child's age in the complaint. Don't pad the file with extra theories.
Work the company first
California's private California Consumer Privacy Act (CCPA) lawsuit path, described by the Attorney General, requires written notice and a 30-day chance to cure certain violations before you sue. Credit disputes belong with the bureau first. Even when no statute forces a first email, your later FTC or attorney general packet is stronger if it shows you already asked.
- Capture the live listing, the privacy-policy language you relied on, and every auto-reply.
- Write down dates and confirmation numbers. "Sometime last winter" will not help a reviewer.
- Send a deletion or correction request through the broker's own form or privacy email and save the sent copy.
- Give the company the time its policy (or the statute that actually applies) claims, then escalate with that timeline attached.
Export PDFs, not phone photos.
Put your name as it appears, the URL, what you want deleted, and the date of any earlier request. Skip legal citations you cannot back up. This is general consumer information, not legal advice.
California's DROP deletion list
Turns out California built a single deletion list.
The Delete Request and Opt-out Platform lets a verified California resident submit one deletion request that registered data brokers must process. The consumer portal has accepted submissions since January 1, 2026. Beginning August 1, 2026, registered brokers must access DROP at least once every 45 calendar days to download and process deletion requests. After a match, they have 45 days to report a DELETED status, according to the California Privacy Protection Agency's processing instructions.
You'll have to show you're a California resident, and if the automated checks bounce you, the platform describes a review path rather than a dead end. DROP is a deletion queue, not a fine. Keep the confirmation. If a registered broker still has the record after those windows, that receipt is the exhibit you attach to a California complaint.
The CCPA still sits next to DROP. You can opt out of sale or sharing, and some browsers can send a Global Privacy Control signal. If you ever plan a consumer lawsuit for certain CCPA violations, the Attorney General's office says you must first tell the business in writing which sections it broke and allow 30 days for a written cure.
The FTC path for ignored policies
Use the Federal Trade Commission's ReportFraud intake when the story looks like unfair or deceptive conduct, such as a no-sale promise followed by a sale. Name the company and paste the policy sentence. Attach the ignored request. The FTC uses these reports to see patterns. It isn't a help desk that will call the broker for you.
To be honest, people file the same three-line rant in five portals on one afternoon and then feel stuck when nothing moves, because none of those filings included the one dated confirmation that would have made the timeline obvious.
If a child under 13 is in the dataset, put that in the first paragraph of the narrative. Don't bury it.
Credit reports are a different door
Inaccurate information on a consumer report is not an FTC privacy form first. 15 U.S.C. 1681i tells you to dispute that item with the consumer reporting agency. Send the bureau what is wrong and why. Keep the receipt.
If the same error is still sitting there after that investigation, file a CFPB complaint. The Consumer Financial Protection Bureau takes complaints about credit reports and other personal consumer reports. Companies generally respond in about 15 days. You then have 60 days to comment on that response.
Don't open a CFPB case to delete a people-search page. Wrong tool.
Your state attorney general
Your state attorney general can take a consumer-protection complaint when a broker is targeting people in that state. Attach the same dated packet, and don't expect a faster personal outcome just because the letterhead is local.
Which channel fits
| Channel | Use it when | It will not |
|---|---|---|
| DROP | You are a California resident and want registered brokers to delete | Fine the company or pay you |
| FTC ReportFraud | A privacy promise looks deceptive, or a deletion request was ignored | Assign you a caseworker |
| CFPB | A credit or consumer report stayed wrong after you disputed with the bureau | Take down a marketing listing |
| State AG or California AG | The conduct hits residents of that state, including CCPA issues | Guarantee a lawsuit |
Pick one primary filing that matches the facts. Copying every agency on day one does not multiply your odds.
What filing will not fix
Complaints are free. Results are not promised. Plenty of FTC reports simply feed a database.
Brokers can fail to match you if the identifiers do not line up after they standardize and hash records. A maiden name, an old apartment, a typo in your DROP file, any of those can make a deleted status never appear even when you did everything right, which is infuriating and also why the screenshots of the live URL still matter when you escalate.
Don't treat a web form as a settlement. A lawsuit is a different process with different risks.
Common questions
Can I file without using my real name? Some federal forms let you limit how your name is shown. The broker still needs enough detail to find the record. A fully anonymous deletion request often cannot be matched.
How long does DROP processing take? Brokers must check at least every 45 days starting August 1, 2026. That's the floor, not a personal SLA. Matching and the DELETED report can add time after they detect the record.
Should I file with the FTC and the CFPB together? Only if you truly have both problems: a marketing profile and a credit-report error. Two thin complaints help no one.
If you're a California resident, open DROP first. Save the receipt. If this is a credit line, dispute with the bureau today. Everyone else should export the ignored request and file through ReportFraud or their state attorney general with that file attached.