Yes, you can use a free opt-out template. There isn't one U.S. form for every request.
The correct wording depends on where you live, the recipient, and whether you want to stop data sales, targeted advertising, direct marketing, or broader processing. You have to match all three.
Looking for one official form that covers CCPA, GDPR, and every broker? You won't find it.
The samples below work as copy-and-paste letters. They aren't official government forms. A company may offer an online privacy form instead, and that channel is often the cleanest place to submit.
Save the confirmation either way.
California residents can use a covered business's "Do Not Sell or Share My Personal Information" control, a written request, or a user-enabled Global Privacy Control signal. Other U.S. state laws use different definitions and deadlines. GDPR is separate. It applies only when its territorial rules cover the processing.
Choose the right opt-out request
"Data sale" covers more than one privacy choice. Match the request to your situation.
| Your situation | Request to make | Best channel | What it does not automatically do |
|---|---|---|---|
| California resident and covered business | Opt out of sale or sharing | Business privacy link, GPC, or letter | Delete your data or close your account |
| Resident of a state with a privacy law | Opt out of sale, targeted advertising, or certain profiling, if available | State-specific or business request channel | Guarantee the same rights or deadline in every state |
| GDPR-covered processing | Article 21 objection to direct marketing | Controller, privacy team, or data protection officer | Create a general U.S. privacy claim |
| Data broker holding a profile about you | Broker opt-out and, where available, deletion | Broker portal or California DROP | Reach every other broker |
Read the company's privacy notice first. The notice should name the rights you actually have, the business or broker that holds the data, and the submission methods it accepts. Check that page before you write.
An opt-out is not a request to know what data a company has. It also isn't a deletion request. You can ask for both when the applicable law allows it. State each request separately.
Information to include in a privacy letter
Give the recipient only what it needs to find your account or profile. Extra documents create extra risk.
- Your name as it appears on the account
- The related email address, phone number, username, or postal address
- Your state or country, if it affects eligibility
- An account, customer, or order number when useful
- The exact choices you want to exercise
- A reply email and the date of your request
Don't attach a driver's license or a full Social Security number just because some template mentions verification. If an official portal asks for identity proof, check why it needs that proof, use the secure upload process, and redact unrelated information when allowed.
Say whether you want to keep your account. That stops an opt-out from being treated as a closure or a deletion request.
Free copy-and-paste data sale opt-out templates
Fill in the bracketed fields and delete lines that don't apply. Send the finished letter through the privacy contact named in the company's own notice.
California CCPA and CPRA opt-out letter
Subject: Do Not Sell or Share My Personal Information
Hello Privacy Team,
I am a California resident. I am exercising my right to opt out of the sale and sharing of my personal information under the California Consumer Privacy Act, as amended by the CPRA.
Please apply this request to the account or profile associated with:
Name: [your name]
Email: [your email]
Phone or username: [optional]
Account number: [optional]
Please confirm receipt and tell me how I can verify that this preference is active. I am requesting an opt-out, not deletion of my account or personal information.
Thank you,
[your name]
[date]Start with the company's privacy link when it offers one. The California Attorney General's CCPA guidance covers the right to send a user-enabled GPC signal too. A business that honors a California opt-out must wait at least 12 months before asking you to opt back in.
General U.S. state privacy opt-out letter
Not every state law offers the same menu. Cross out any checkbox the law or the notice doesn't actually support.
Subject: Request to Opt Out of Sale or Targeted Advertising
Hello Privacy Team,
I live in [state]. I request the privacy opt-out choices available to me under [state law, if known].
Please apply the choices checked below to the account or profile connected with my information:
[ ] Sale of my personal data
[ ] Targeted advertising
[ ] Profiling used for decisions with legal or similarly significant effects, if this right applies
Name: [your name]
Email: [your email]
Phone or username: [optional]
Account number: [optional]
Please confirm which choices you processed. If one choice is unavailable, please identify it and explain what additional information, if any, you need to review the request.
This is an opt-out request, not a request to delete my account.
Sincerely,
[your name]
[date]Skip the laundry list of statutes if you haven't checked coverage. A short, accurate request is easier to match than a pile of citations.
GDPR Article 21 objection template
Use this letter only when GDPR's territorial rules actually cover the processing. A U.S. resident isn't automatically covered just because a company operates in Europe.
Subject: Article 21 Objection to Direct Marketing Processing
Dear [controller, privacy team, or data protection officer],
I am [your name], and I believe the GDPR applies to this processing because [brief reason, such as my residence in an EU or EEA country].
Under GDPR Article 21, I object to the processing of my personal data for direct marketing. This includes using my data to create a marketing profile or selling, disclosing, or otherwise sharing it with third parties for direct marketing, where applicable.
Please stop processing my data for those purposes and record this objection against:
Name: [your name]
Email or account ID: [identifier]
Other matching detail: [optional]
Please confirm receipt and identify the correct data protection contact for follow-up.
Sincerely,
[your name]
[date]A GDPR direct-marketing objection is not a CCPA sale opt-out. You can generally object at any time. The controller usually must respond without undue delay, and normally within one month, subject to permitted extensions.
Data broker opt-out and deletion request
A broker may offer an opt-out, deletion, or both. The result depends on the law that covers you and the broker's own process.
Subject: Data Broker Opt-Out and Deletion Request
Hello,
Please search for my profile using the identifiers below. I request that you opt me out of the sale of my personal data and delete my profile if that request is available under applicable law or your policy.
Name: [your name]
Email: [your email]
Phone: [optional]
City and state: [optional]
Other matching detail: [account or reference number, if applicable]
If you cannot process both requests, please identify which request you processed and what separate step is required for the other one. Please confirm the result and tell me how to contact you about a future match.
Thank you,
[your name]
[date]Don't mail the same letter to a guessed address. Find the broker's current privacy page, or use California's DROP platform if you qualify.
How to submit and track the request
Letters can work. The channel still matters.
- Identify the correct recipient. Check the privacy notice and distinguish the retailer, app, advertising partner, and data broker. They may be separate businesses.
- Choose an official channel. Use the business privacy portal when available. Otherwise, send the letter to the privacy email or mailing address named in the notice.
- Provide only matching details. Include the email, phone number, username, or account ID tied to the data. Avoid unnecessary identity documents.
- Save your evidence. Keep the submitted letter, date, web address, screenshots, confirmation email, ticket number, and any GPC setting you used.
- Review the response. Check whether the business processed sale, sharing, targeted advertising, deletion, or only one of those choices.
Thing is, people often send a beautifully formal letter to the wrong inbox. Wording matters less than reaching the business or broker that actually controls the data, and a boring little record makes follow-up much easier.
Don't paste "90 days" into every template. That isn't a universal CCPA opt-out deadline. California's familiar 45-day response period generally concerns certain know or delete requests. The California Privacy Protection Agency FAQ discusses a 10-day receipt confirmation for know, delete, and correct requests. Those are different request categories.
Other state laws set their own response frameworks. Read the recipient's notice instead of promising a deadline the law may not provide.
Use Global Privacy Control for browser-based opt-outs
Global Privacy Control lets a user-enabled browser or extension send an opt-out preference signal. California guidance treats that signal as a legally binding exercise of opt-out rights where the CCPA applies. Some other states also require or recognize universal opt-out mechanisms.
The W3C GPC explainer describes how the signal works. Turn it on in a supported browser or extension, visit the business site, and check the site's privacy settings when you can.
Save a screenshot of the setting.
A GPC signal communicates an opt-out preference. It does not ask the company to disclose or delete your data. An account-specific request may still help when the business needs to match several emails, devices, or accounts.
California's DROP platform for data brokers
California residents who want data broker removal can use the Delete Request and Opt-out Platform, or DROP. You'll have to verify California residency before a deletion request is accepted.
Turns out DROP is built for registered California data brokers, not every company that ever saw your email. It combines deletion and sale opt-out activity, so read the platform terms before you submit if you only want to stop a particular use of your data.
Beginning August 1, 2026, the platform's published information says data brokers must process deletion requests at least once every 45 days. Keep the confirmation you receive. Review later results. DROP is not a universal U.S. switch for every company that has your information.
If you aren't a California resident, use each broker's official privacy page. Track those requests separately and ask for the minimum verification needed.
What an opt-out changes, and what it does not
| Request | Main target | Separate action you may still need |
|---|---|---|
| Sale or sharing opt-out | Covered sale or sharing after the request is honored | Deletion, access, or correction |
| Targeted advertising opt-out | Covered use of data for targeted ads | Sale or sharing opt-out if listed separately |
| GDPR marketing objection | Direct marketing processing | Deletion, restriction, or access |
| Deletion request | Erasure of data, subject to exceptions | Opt out with other businesses or brokers |
A successful opt-out may not pull data back from another recipient that already has a copy. It also may not stop ordinary first-party advertising, service messages, fraud prevention, or other uses the applicable law still allows.
A company may say it receives data to provide a service rather than to sell it. Ask which activity it classified. Ask which privacy control it applied.
If a company ignores the request
Send one clear follow-up first. Put the original date, ticket number, requested choice, and proof of submission in that note.
| Where the issue occurred | Practical escalation |
|---|---|
| California | Review the California Attorney General's CCPA page and CPPA FAQ, then use the agency complaint route that fits the issue |
| Another U.S. state | Contact the state attorney general or privacy regulator through its official website |
| GDPR-covered processing | Contact the controller or data protection officer, then the relevant supervisory authority |
| Data broker | Use the broker's formal privacy process; California residents can review DROP eligibility |
A complaint helps an agency review possible violations. It doesn't guarantee deletion, damages, or a particular response time.
To be honest, an ignored opt-out is not automatically a private damages claim. California's Attorney General says that, before suing for a CCPA violation where a private action is available, written notice identifying the CCPA sections at issue and a 30-day opportunity to cure may be required. The CCPA private right of action is limited.
Frequently asked questions
Is there one official downloadable U.S. opt-out form?
No. There's no single federal form that covers CCPA, CPRA, every state law, GDPR, and all data brokers. You can paste the matching sample into a document and save or print it. Use the company's official portal when it provides one.
Can I use the California template for every U.S. company?
You can adapt the wording. Don't claim California rights if you aren't eligible. Swap in the state rule that applies, or make a plain privacy-choice request without citing a statute you haven't checked.
Does an opt-out delete information already collected?
Usually, an opt-out and deletion are separate choices. Ask for deletion separately if you want the company to erase your information and the applicable law or policy provides that option.
What should I do if a company asks for identity verification?
Use only the company's official privacy channel. Ask what information is necessary, give the least sensitive matching details, and skip a full Social Security number or unredacted identity document unless the secure process clearly requires it.
Pick one recipient. Open its privacy notice, choose the narrowest matching template, submit through the official channel, and save the confirmation with the date.