An inaccurate data broker profile can follow you across people-search sites, marketing databases, and reports used by decision-makers. Watch the response, not just the original listing.
A vague denial, unsafe identity check, or profile that keeps returning deserves scrutiny. There isn't one U.S. dispute deadline or form for every data broker. The answer changes if the company is a people-search site, a covered data broker, a consumer reporting agency, or simply repeating a government record.
Start by identifying what you are disputing
People often use "data broker" for several different businesses. That label alone does not tell you which process applies.
| What you found | Where to start | Important limit |
|---|---|---|
| A people-search profile with an incorrect address, phone number, or relative | The company's official privacy, removal, or correction page | Removing one listing may not fix the source record or other sites |
| A report used for credit, employment, housing, insurance, or another eligibility decision | The company's consumer reporting dispute process | The Fair Credit Reporting Act may apply, but not every profile website is a consumer reporting agency |
| An incorrect court, licensing, or government record | The agency or court that keeps the original record | A broker may republish the error after its copy is changed |
| A California data-broker deletion request | The applicable California privacy process, including DROP where available | California rules do not automatically govern every U.S. broker |
Some distinctions matter immediately. If a broker's information affected a job, apartment, loan, or insurance decision, preserve every notice you received.
Ten red flags in a data broker dispute
These warning signs do not prove a legal violation by themselves. They tell you to slow down, preserve evidence, and ask better questions.
| Warning sign | Why it matters | What to do |
|---|---|---|
| 1. A boilerplate denial | "Not verified" does not identify the field, date, or evidence reviewed | Name the exact error and request a clear outcome |
| 2. No receipt or case number | You may not be able to prove when the request arrived | Save the confirmation screen and ask for written acknowledgment |
| 3. An open-ended delay | "Under review" gives you no usable next date | Ask when the review will finish and whether an extension applies |
| 4. Excessive identity verification | Full Social Security numbers, selfies, or biometrics create new privacy risks | Ask why each item is needed and use only a verified channel |
| 5. An unverified contact channel | Lookalike domains and unsolicited messages can lead to impersonation scams | Open the company's website yourself instead of following a message link |
| 6. A paid removal guarantee | A third-party promise of permanent or guaranteed removal may be marketing, not a result | Start with the broker's direct process and read any service terms |
| 7. Confusion between deletion and correction | "Removed" may mean one page changed while the inaccurate source remains | Ask whether the item was corrected, deleted, suppressed, or merely hidden |
| 8. Continued display or distribution after acknowledgment | The business knows about the disputed item but has not explained its handling | Save dated copies and ask what action was taken while the review was pending |
| 9. The same error returns | A new data feed or source may have repopulated the profile | Compare the old and new listings and identify the source |
| 10. No clear data controller | A vague redirect can send you from one company to another indefinitely | Ask which legal entity holds the record and where to appeal |
A delay alone is not automatically unlawful. The applicable deadline may come from a state privacy law, a company policy, or a different law altogether.
What a useful response should tell you
A meaningful response should let you understand what happened. It may not reveal every confidential source or internal method, but it should not leave you guessing about the result.
Look for:
- The exact information the company reviewed.
- Whether it corrected, deleted, suppressed, or left the information unchanged.
- The reason for the result and any source information it can lawfully provide.
- The date the change took effect.
- A way to appeal, submit more evidence, or contact the privacy team.
The wording matters. "Your dispute was not upheld" is not very helpful unless the company also identifies what it reviewed and why.
Protect yourself during identity verification
Thing is, a legitimate business may need enough information to confirm that you are the person connected to a profile. That does not make every verification request reasonable or safe.
Check the website address yourself. Read the privacy notice. Ask what the company needs, how it will use the information, and whether a less sensitive option is available. Never send a Social Security number, full identity document, or biometric file by replying to an unsolicited email.
A redacted identity document may be enough for some requests. If you provide one, cover numbers and details that are not needed for matching, add a watermark stating the purpose, and keep a copy of exactly what you submitted.
A practical dispute workflow
-
Capture the evidence. Save the profile URL, screenshots, the date, and the exact inaccurate statement. Keep any email, report, or decision that shows how the information affected you.
-
Identify the business. Find the company's legal name, privacy page, contact details, and terms. Check whether it describes itself as a consumer reporting agency or only as a people-search or marketing service.
-
Choose the request. Decide whether you want correction, deletion, suppression, access to your information, or an opt-out from sale or sharing. These are different requests.
-
Write narrowly. State what is wrong, what the correct information is, and what action you want. Avoid sending a long personal history that contains unrelated sensitive details.
-
Use a verified channel. Submit through the official portal or mailing address. Save the submission, attachments, confirmation number, and any stated response date.
-
Track the response. Put the promised date on your calendar. If no date was provided, send a brief follow-up that identifies the original request and asks for its status.
-
Check the result. Search the original page again and check any report that used the information. A confirmation email is not the same as a verified correction.
A simple request can look like this:
I am disputing [specific field] in the profile associated with [safe identifier]. The listing says [wrong information]. The correct information is [correct information]. Please correct or delete this item, tell me the result of your review, and explain any appeal or verification step.
Keep the request factual. Do not include more personal information than the company needs to locate the record.
California's DROP schedule is a separate issue
California has a specific data-broker deletion mechanism that should not be confused with a general U.S. dispute deadline.
The California Privacy Protection Agency's data broker guidance says that, beginning August 1, 2026, data brokers must access the Delete Request and Opt-Out Platform, known as DROP, at least once every 45 days to download and process consumer deletion requests, subject to limited exceptions.
The DROP processing instructions say that a broker must report a "DELETED" status within 45 days of detecting the change. That schedule governs how covered brokers process DROP requests. It is not a universal response deadline for every dispute, every company, or every state.
If you use a California privacy process, save your confirmation and the date of submission. Ask whether the request concerns deletion, correction, or both.
When the Fair Credit Reporting Act may change the process
People-search listings and consumer reports sit in different legal lanes. If a company prepares information for a decision about credit, employment, housing, insurance, or similar eligibility, the Fair Credit Reporting Act may apply to the company and the dispute.
In that situation, use the reporting company's formal dispute process and request the file or report that was used. Preserve an adverse-action notice, the report, your dispute, and the response. The company's marketing label does not settle whether the FCRA applies.
A government record creates another distinction. The CFPB's Privacy Act amendment and appeal page describes a correction process for records held by the CFPB itself. It is not a general dispute rule for commercial data brokers. If a broker copied an incorrect public record, correcting the original court or agency record may be necessary to stop the error from returning.
Escalate with a record of what happened
Escalation works better when you can show a clean timeline. Keep the original listing, your request, the company's acknowledgment, every response, and the current version of the data in one folder.
Start with the broker's privacy contact or appeal route. If the company made deceptive claims, mishandled sensitive information, or ignored a documented request, you can report the conduct to the Federal Trade Commission and your state attorney general. Describe the exact statement or action instead of simply saying that the company was unfair.
California consumers can review the CPPA's current data-broker materials for the applicable process. If inaccurate information affected employment, housing, credit, or another important decision, consider speaking with a consumer-law attorney or legal aid organization. Time-sensitive consequences may need attention before the broker finishes its review.
Regulators can record complaints and investigate patterns. They may not correct an individual profile for you.
Mistakes that make disputes harder
To be honest, the fastest-looking dispute can be the weakest one. Sending a full identity packet, using a paid removal company without checking its terms, or demanding that every mention of you disappear can create confusion and more exposure.
Be specific instead. Identify one inaccurate item, attach proof that directly addresses it, and state the result you want. If the data is accurate but unwanted, request deletion or an opt-out rather than calling it inaccurate.
Do not assume that one successful removal covers every website. Data can come from different sources, and a new copy may appear later. Recheck the original page and search for other companies separately.
Questions that come up
Is a late response automatically a legal violation?
No. The controlling deadline depends on the type of request, the company, the state, and whether a law such as the FCRA applies. California's DROP access schedule is specific, but it is not a national rule for every broker.
Can I demand the source of the data?
You can ask. Whether the company must reveal a particular source depends on the applicable law and the type of record. A refusal to provide every source detail is not automatically proof that the data is accurate, but a vague denial still leaves you with a reason to request a clearer explanation.
What if the same information appears on several sites?
Treat each site as a separate request and compare the wording, dates, and source clues. If the error began in a court or government record, contact that record holder as well. Otherwise, the same incorrect information may keep coming back.
Should I pay a service to remove my information?
A paid service may be a consumer choice, but a guarantee is not proof of permanent removal. Before paying, check what the service actually covers, how it handles new listings, what evidence it provides, and how cancellation works. You can often begin by contacting the broker directly.
This is general consumer information, not legal advice.
Your next move
Save a dated screenshot today, type the broker's website address into your browser, and send a narrow request that names one error and the correction you want.