Short answer: Turn on Global Privacy Control (GPC), file a privacy request on each company's own site, and contact data brokers one by one. California residents can also use the state's DROP platform to ask registered brokers to delete information. Those steps can limit future selling or sharing. They don't automatically wipe every record a business already holds.

U.S. options depend on your state, the company, and whether that company is even covered. Eligibility, deadlines, and definitions are not uniform.

Know which privacy result you want

"Opting out of data sales" is not one action. Match the request to the outcome you actually want:

California law gives "sale" and "sharing" specific meanings. A transfer tied to cross-context behavioral advertising may be covered even when nobody pays cash for the information. Ordinary website tracking is not automatically a legal sale, so use the company's stated privacy choices instead of guessing.

Step 1: Turn on Global Privacy Control

GPC is a browser or device signal that tells participating sites you want to opt out. California recognizes a user-enabled global privacy control as a way to submit an opt-out request under the CCPA.

Start at Global Privacy Control for supported browsers, extensions, and setup instructions. Enable the signal in every browser, device, and profile you actually use. Test it on a site that shows a privacy-choices panel, and save a screenshot if the business confirms it received or honored the signal.

GPC is not a deletion request. It also isn't a master switch for every broker or website. Outside laws that require recognition, a company may treat it as a preference only. If the site still offers a sale, sharing, or targeted-advertising control, submit that request manually.

A cookie blocker or "Do Not Track" setting is not the same as GPC. Blocking a tracking script can cut collection in your browser. It does not tell a data broker to delete your profile.

Step 2: Submit a request directly to the business

Use the company's own privacy page. Skip search ads, unofficial directories, and lookalike forms.

Check the website footer or privacy policy for labels such as Do Not Sell or Share, Your Privacy Choices, Privacy Choices, Opt out of targeted advertising, or Limit the use of sensitive personal information.

Pick the option that matches your request. Identify your state of residence accurately, and give only the details needed to match your account or profile. Finish any email or account verification the form requires. Save the confirmation email, request number, date, and screenshots.

For a written request, language like this is enough:

Please process my request to opt out of the sale or sharing of my personal information and, where applicable, targeted advertising under the privacy law that applies to my state of residence. Please confirm whether you need additional verification and when the request takes effect.

An opt-out is not a request to know or delete. If you want information removed, say so separately and follow the company's verification process. Don't send a Social Security number or an unredacted ID to an unfamiliar form.

California: CCPA and CPRA opt-out steps

The CCPA, as amended by the CPRA, gives eligible California consumers rights that can include opting out of the sale or sharing of personal information, requesting deletion, and limiting certain uses of sensitive personal information.

Not every business is covered in the same way. Coverage can depend on the company, its activities, and statutory thresholds. The California Attorney General's CCPA guidance explains the rights and business obligations.

On a California business site, open the privacy policy or privacy-choices page and choose Do Not Sell or Share My Personal Information. Submit the request for the relevant account, browser, or household option. Complete only the verification the business legitimately requires, keep the confirmation, and check whether the choice applies to future activity.

You can also use GPC as a California opt-out signal. A business generally must wait at least 12 months before asking a California consumer who opted out to opt back in.

An opt-out does not normally force the company to stop providing a service, close your account, or remove information needed for security, legal compliance, or the transaction itself. If deletion is the goal, file a deletion request instead.

California's DROP platform for data brokers

California residents have a separate route for registered data brokers: the Delete Request and Opt-out Platform, or DROP.

Open the platform, review its terms, and complete California residency verification before a deletion request goes in. DROP's terms define residency by section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017. If the verification providers cannot confirm residency, the terms describe a review of that classification under section 7622 of Title 11 of the California Code of Regulations.

Save the confirmation and any reference number, then check the platform or broker notices for status.

Registered data brokers must process deletion requests at least once every 45 days beginning August 1, 2026. That is a processing schedule, not a promise that every record vanishes on the day you click submit. DROP targets registered data brokers. It does not replace a direct sale-or-sharing request to a retailer, app, social network, or other business.

If you live outside California

There is no single U.S. form that covers every business and data broker. Other state privacy laws differ on who qualifies, whether the right covers data sales, targeted advertising, or profiling, whether a universal opt-out signal must be honored, what verification a business may request, and how the business must respond.

Start with the company's privacy notice and select the option for your actual state of residence. If it offers only a California form, write the privacy or data-protection address and ask which process applies to you.

If the request is denied, ask for the reason in writing. A denial may rest on a legal exception, an inability to match your information, or the company's view that the request falls outside the law. Keep that explanation if you later contact your state attorney general or privacy regulator.

Remove listings from data brokers and people-search sites

A company's opt-out does not automatically clear your profile from a separate broker. Sites such as Spokeo and Acxiom keep their own privacy centers, forms, and verification rules.

Visit the broker's current official website. Search your name, phone number, email address, and past locations. Open the privacy, suppression, or opt-out page. Choose deletion if you want the record removed and the broker offers that option; choose suppression or a sale opt-out when that is all that's available. Submit the minimum information needed to identify the listing, finish the confirmation email or other verification, and record the date, URL, request type, confirmation, and expected response. Search again later to see whether the listing returns.

An opt-out may hide a profile from public search or stop certain uses without deleting every underlying record. Deletion rights and exemptions depend on the broker's coverage and the law that applies to you.

Should you pay for a removal service?

Automated privacy services can submit and monitor requests for you. They don't create a new legal right, and they can't guarantee that every broker will remove your information or never reacquire it.

Before you subscribe, check the current price and automatic-renewal terms, which brokers are actually covered, whether the service handles deletion, suppression, or only opt-out requests, how often it checks for returned listings, what identity documents or personal details it stores, and how cancellation and support work.

A manual log is free and leaves you in control of the files. A paid service is mainly a convenience decision.

Reduce personalized advertising separately

Advertising controls can cut behavioral targeting. They are not a substitute for a state-law privacy request.

Use Google My Ad Center for Google advertising personalization and YourAdChoices for participating companies' interest-based advertising choices. Review privacy and advertising settings inside social-media, shopping, and streaming accounts. On iPhone or Android, use the operating system's privacy settings to limit app tracking and reset or restrict the advertising identifier. A browser with stronger tracker blocking can change what happens in that browser. It does not erase broker databases.

Unsubscribing from marketing messages only changes communications. It does not necessarily stop the company from selling, sharing, or retaining personal information.

Keep evidence and escalate carefully

Keep a simple spreadsheet or note with the business or broker name, the exact request, the privacy-page link, date and time, email or request number, verification completed, expected timing, final result, and the date you checked again.

If a company ignores the request, send one concise follow-up with the original confirmation attached. Don't keep resubmitting identical forms after a case is already open.

California residents can review complaint information from the California Attorney General and the California Privacy Protection Agency. Residents of other states should use the privacy complaint route from their state attorney general or privacy regulator. A complaint may support enforcement. It does not guarantee immediate deletion or payment.

Submit sensitive information only on official domains. Privacy scams often imitate broker forms and ask for more identity data than necessary.

Common questions

Does GPC stop all data sales?

No. GPC can communicate an opt-out preference to websites that support it or are required to recognize it. It does not reach every broker, delete stored information, or change settings on accounts that ignore the signal.

Is opting out the same as deleting my data?

No. Opting out generally asks a business to stop a covered sale, sharing activity, or targeted advertising. Deletion asks the business or broker to remove information, subject to applicable exceptions.

Will unsubscribing from email stop a data broker from selling my information?

No. Email marketing and personal-data sales are separate. Use the privacy center or broker opt-out form as well as the unsubscribe link.

Can anyone use California's DROP platform?

DROP requires California residency verification. If you cannot confirm residency through the platform's verification providers, its terms describe a review process. Consumers outside California should use the rights and broker procedures available in their own state.

Enable GPC in the browsers you use every day, then open the privacy page for the company that concerns you most and file the direct sale-or-sharing request. Save the confirmation before you move on to DROP or individual broker forms.