Some companies collect your insurance claims, coverage details, and related personal data, then sell the combined file to other businesses. They're often called policy data brokers.
They aren't your insurer. They don't service your policy. They build a resale file and shop it to underwriters, lenders, and other buyers.
Why would a firm you never hired know your last claim? Someone matched records and put a price on that match.
U.S. consumers can push back. California residents can send one deletion request through the state's DROP system. Everyone else usually works company by company, using privacy forms and, in some states, a right to opt out of data sales.
What a policy data broker is
A policy data broker buys or licenses insurance-related personal information, enriches it, and sells access. The product is a risk file, not a copy of your policy contract.
Thing is, you rarely signed up with them. The name shows up later, after a quote, a denial, or a search for your own records.
What they usually hold
Files vary. Many include the identifiers needed to match you: name, address history, date of birth, and sometimes a vehicle or property record.
Claims and underwriting data are the point of this niche. A broker may also attach inferred scores, household details, or data bought from other compilers.
| Kind of data | Why it gets sold |
|---|---|
| Identity and address history | Match you across sources |
| Claims and coverage history | Help price or flag risk |
| Inferred scores | Summarize you for a buyer |
Not every broker holds health data. Ask before you assume they don't.
Using California DROP to request deletion
California's Delete Act created a central deletion path for residents. You submit through the Delete Request and Opt-out Platform (DROP). The site will ask you to verify that you are a California resident.
Registered brokers have to check that system on a clock. California guidance for brokers says they must access DROP at least once every 45 calendar days beginning August 1, 2026, download consumer deletion lists, match hashed records, and process the requests. They then report a DELETED status within 45 days of detecting the match.
The CPPA data broker page is the official hub for registration rules.
Do this in order:
- Confirm you meet DROP's California residency check. If the automated check fails, the site describes a review path.
- Submit one deletion request on the consumer DROP portal. Save any confirmation you get.
- Wait for the broker cycle. A 45-day pickup window means this is not same-week cleanup.
- Search your name later on people-search and insurance-data sites. Resale can put data back.
DROP reaches registered California data brokers. It does not empty your insurer's own account, and it does not hit every website that ever displayed your address.
If you live somewhere else in the U.S.
You can still ask a broker to delete your information or stop selling it. Look for a "Do not sell" or privacy-request link on that company's site. Response times are often measured in weeks, not hours.
Some states give residents a statutory opt-out of personal-data sales. The form and the deadline live in that state's law and on the company's privacy notice. This page can't map every state.
Turns out the California registry still helps as a phone book. Open the CPPA registered broker list, note names that sound like insurance or risk data, then use each firm's own request form. If a company never answers, you send the same ask again, you keep the dates, and you accept that some of these databases are messy enough that a "deleted" flag in one place does not mean the next reseller is clean.
When the file includes health information
HIPAA is the rule people name first. It binds many insurers, doctors, and clearinghouses. A data broker that purchased a copy of health-related details is frequently outside that box, which is how a sale can happen even when you never clicked "I agree" on the broker's site, and why chasing only your insurer often leaves the resale copy untouched.
The FTC tells companies that collect, use, or share consumer health information to look at HIPAA where it applies, and also at the FTC Act and the Health Breach Notification Rule. Read the agency's guidance on consumer health information if a health-related broker leak or sale is your issue.
To be honest, a lot of opt-out forms never mention health fields as a separate category. If you know a broker has medical-adjacent data, say so in the request and keep the email.
Get a copy from a risk-data firm
A few large companies let you pull what they hold. LexisNexis Risk Solutions offers an online consumer disclosure request. California residents can receive an FCRA-style report plus a California privacy report.
Use that when the data may affect insurance eligibility. DROP is a deletion broadcast. A disclosure request is how you see the file.
If the broker ignores you
Save the request, the date, and any case number. For DROP problems with a registered broker, the California Privacy Protection Agency runs the system. For deception, ignored health-data promises, or unfair practices, you can complain to the FTC.
Your state attorney general may take privacy complaints too. Outcomes vary. Nobody can promise a deletion just because you asked.
FAQ
Does DROP delete my actual insurance policy file? No. It targets registered data brokers. Your carrier still keeps the records it needs to service the policy.
Can I use DROP if I used to live in California? DROP requires you to verify you are a California resident under the definition the site uses. If you can't verify, use that broker's own privacy form instead.
If you're a California resident, start on the DROP consumer site, finish the residency check, and store the confirmation. If you're not, grab names from the CPPA broker list and send written deletion or do-not-sell requests to the firms that look like insurance-data sellers, then calendar a follow-up in 45 days.