You opt out of data sales through each broker or company's privacy request channel, then through the state or GDPR right that actually covers you. There is no nationwide form. An advertising switch usually doesn't delete an account.
Enable a recognized privacy signal first. Then remove people-search profiles, submit the state requests that apply, and review the accounts you use most. Keep a record, because listings can return or appear on another site.
What an opt-out actually changes
Data brokers and people-search sites pull public records, online activity, and commercial data, then sell reports or share them with advertising partners. Turns out those uses aren't one request. A request can block one use and leave the record.
A business privacy setting is narrower than a legal deletion request. Read the wording before you submit.
The hands-on removal workflow
Each company and each broker needs its own pass. Work through this sequence:
- Make a private inventory. List your current and former names, phone numbers, email addresses, cities, and usernames. Don't put your Social Security number in a spreadsheet or ordinary email.
- Search for profiles. Search your name with a city, phone number, or email address. Record the exact profile page, not just the site's home page.
- Choose the right request. Look for options such as "Do Not Sell or Share," "Opt out of targeted advertising," "Remove my information," or "Delete my data."
- Provide only necessary details. A site may need enough information to match your record. Use its official domain, and verify requests through the email it sends.
- Save evidence. Keep the date, request type, profile URL, confirmation email, and any response. Save the confirmation. Save the date too.
- Repeat and recheck. A request to one company doesn't reach its competitors. Check again after the site's stated processing period, then repeat the process when a listing returns.
Don't follow a search result onto a paid report or a lookalike opt-out page. Type the company name yourself. Confirm you landed on that company's own privacy page.
Find people-search listings first
Start with listings that show your address or phone number. The Federal Trade Commission's guidance on people-search sites recommends finding your profile, locating the site's opt-out instructions, and repeating the process on other sites.
Before you submit a request, note:
- The profile's exact web address.
- The name, phone number, and location shown.
- The email address used for verification.
- The date you submitted the request.
An opt-out usually suppresses a listing on that particular service. It may not remove public records, information held by another broker, or details copied into a relative's, neighbor's, or associate's report. The FTC specifically warns that your information can remain visible through related reports.
If a site asks for an identity document, confirm the request is on the official domain. Redact unrelated numbers if the site permits it. Never send a password.
Match the request to your US state
Your state, the company, and the kind of processing decide which request actually binds anyone. State privacy laws don't create one nationwide broker-removal form.
| Location | First route to try | Main limitation |
|---|---|---|
| California | Use the business's privacy choices, enable GPC, and consider California DROP for registered data brokers. | DROP has residency checks, a defined broker scope, and exceptions for certain data. |
| Colorado | Use the controller's privacy request channel and select the sale, targeted advertising, or applicable profiling choice. | The right may apply only to covered businesses and specified profiling. |
| Virginia | Use the business privacy form or privacy email and request the applicable sale or targeted-advertising opt-out. | The request usually reaches that controller, not every broker holding similar data. |
| Texas, Oregon, and other covered states | Check the privacy notice for a consumer-rights form, then consult current state regulator guidance if needed. | Eligibility, exemptions, response steps, and appeal rules vary. |
Look for "Privacy Choices," "Your Privacy Rights," or "Do Not Sell or Share" on the company's site. If the form lists several choices, pick the one that matches your goal. Don't tick every box by habit.
For a covered state request, you can write:
I am exercising my applicable privacy right to opt out of the sale of my personal information and targeted advertising. Please confirm the scope of this request, any identity verification you need, and the result.
Give your name and the account or contact details needed to identify the record. Don't volunteer extra sensitive information.
California's centralized DROP route
California residents can use the Delete Request and Opt-out Platform, or DROP to submit a deletion request to registered data brokers. You have to verify residency first.
DROP's terms describe a review process if the verification providers can't confirm your California residency. Read those terms before you send anything, especially if an exception might apply to your information.
The California Privacy Protection Agency's data broker information says that, beginning August 1, 2026, data brokers must access the accessible deletion mechanism at least every 45 days and process consumer deletion requests, subject to limited exceptions. That duty applies to registered data brokers using the mechanism.
DROP is not a universal delete button for retailers, apps, employers, websites, or every public record.
To use it:
- Open DROP and review its terms.
- Complete the California residency verification.
- Check the information and request details before submitting.
- Save the confirmation and watch for any follow-up verification.
- Continue with separate requests for businesses outside DROP's broker scope.
Use Global Privacy Control for recurring site choices
GPC, or Global Privacy Control, sends a privacy preference from a supported browser or extension. Supported options are listed on the Global Privacy Control website.
The W3C GPC explainer notes that California guidance treats a GPC signal as a legally binding exercise of certain opt-out rights under California law. Other jurisdictions and websites may apply the signal differently.
Turn it on in every browser you use. If a site asks whether the signal should apply to your account, check that privacy-choice screen.
Thing is, GPC is not a deletion request. It won't erase old broker profiles, strip account history, or halt every kind of first-party collection. Treat it as one layer.
If GDPR covers your situation
GDPR does not ban the sale of personal data outright. Covered people get rights over processing, including a strong right to object to direct marketing under Article 21(2).
If you're in the EU or EEA, GDPR may apply. A US resident is not covered automatically just because a company is headquartered in Europe. Territorial scope and the processing context matter.
Send the request through the company's privacy portal or its data protection officer. Ask for a direct-marketing stop, details about recipients, and deletion where the right to erasure applies.
You can adapt this wording:
I object to the processing of my personal data for direct marketing under Article 21(2) of the GDPR. Please stop direct marketing and confirm whether my data is shared with data brokers, advertising partners, or other recipients. I also request erasure of data where the right to erasure applies. Please confirm the action taken and explain any part of the request you cannot fulfill.
You'll need the account email or customer number to locate your record. Keep a copy of the request and the response.
GDPR exceptions still matter. A company may retain information needed for a contract, legal duty, security, fraud prevention, or another lawful purpose. If the controller doesn't resolve the issue, you can consider contacting the relevant data protection authority.
Big Tech settings are narrower than deletion requests
Big platforms usually label these controls as ad personalization, activity settings, or partner-data tools, not a general data-sale opt-out. Match the setting to your actual goal. One switch will not cover every service.
| Service | Where to start | What the setting usually does not do |
|---|---|---|
| Google My Ad Center and the Google Account Data and Privacy controls. | Turning off personalized ads doesn't necessarily erase account history or stop all Google data processing. | |
| Meta | Meta's off-platform activity controls and Accounts Center ad preferences. | Reviewing partner activity doesn't remove your posts, account records, or every tracking event. |
| Amazon | Amazon privacy and ad personalization controls. | Ad choices don't erase order history or information needed to provide purchases and accounts. |
| Apple | Apple's current privacy controls, including tracking and advertising settings. | App developers and individual services can have separate privacy controls and data practices. |
Turn off personalized advertising if you don't want behavior-based ad selection. Location and cookie controls sit on other screens. Contacts, microphone, and connected apps do too.
If you want the account deleted, use the platform's account deletion or privacy request process. Ad settings aren't a substitute.
Should you pay for a removal service?
A paid removal service can take the repetitive searching off your plate. It still can't force every company to delete data. Coverage depends on the sites the service actually contacts.
To be honest, precise broker counts and success percentages are hard to compare, especially when profiles reappear or a company matches you incorrectly. A provider's own figure is not a guarantee.
| Method | Useful when | Check before choosing |
|---|---|---|
| Manual requests | You want control and have a manageable list. | The work is repetitive, and one request covers only one service. |
| Automated removal service | You want recurring searches and submissions. | Review the broker list, scan frequency, subscription renewal, cancellation, refund, and data-retention terms. |
| California DROP | You are a California resident seeking deletion from registered data brokers. | Confirm residency, scope, and exceptions before submitting. |
| GPC | You want an ongoing browser-level preference on participating sites. | It is not a deletion tool and may be device- or browser-specific. |
Free tools are enough for a first pass. Pay for a subscription only if recurring monitoring is worth the cost and you accept the provider's privacy practices.
Before you pay, find out which sites are included and what happens after cancellation. Ask how the service protects the information you hand over.
Limits, exceptions, and safety
An opt-out will not recall copies already sold, undo a data breach, or wipe records a company must keep for a lawful business or security purpose. It's not a time machine.
A credit freeze only blocks certain new-credit fraud. It doesn't take down a people-search profile. OptOutPrescreen handles prescreened credit and insurance offers, not general data-broker listings.
Have I Been Pwned can show whether an email appears in known breach data. That check does not submit a broker opt-out.
People move and change numbers and create accounts and get listed through somebody else's record, so a clean search today can become a new listing later, which is annoying and also normal for this kind of cleanup.
If stalking or domestic violence is the concern, use a safer device and email account where possible. Share only what the official process requires. Check whether the site offers a safety or suppression procedure before you expose a current address.
Keep proof and escalate carefully
Save proof while you still have it. A log with the business name, request date, channel, profile URL, response, and follow-up date makes a later challenge much easier.
If a company denies the request, ask for the reason and use the appeal process when one exists. If it ignores you or mishandles the information, follow the complaint instructions from the relevant state privacy regulator or attorney general. California readers can check the CPPA data broker page for current program information.
Keep the controller's response to a GDPR request. Contact the relevant supervisory authority if that response is missing or inadequate. Don't pay an unknown company that promises to make a regulator act faster.
Your next step
Write down the first people-search profiles that show your address or phone number, turn on GPC, and save each confirmation in a private note today. Recheck those pages after each site's stated response period.