You can dispute bad data a broker holds about you. There's no single national form that covers every company, though. Your rights depend on two things: the kind of company and your state. That split matters. Send the wrong request and you can lose weeks.
Turns out, the process splits into two tracks. Consumer reporting companies follow one. General data brokers often follow another.
Credit bureaus are not the same as data brokers
Equifax, TransUnion, and Experian are the three nationwide consumer reporting companies. The CFPB uses that label. Its list also includes specialty firms that track rental, employment, insurance, and other records. Start with the CFPB's list of consumer reporting companies. That page tells you which category a company falls into.
The CFPB says you can request up to six free copies of your Equifax credit report in any 12-month period through December 2026. That route is separate from general data brokers that sell marketing profiles or location data.
Many marketing data brokers are not consumer reporting agencies. They may hold your name, address, phone number, purchase habits, or device data. The Fair Credit Reporting Act gives you dispute rights with consumer reporting agencies. It does not give you the same correction right with every general data broker.
What controls a data broker dispute
For consumer reporting agencies, federal credit reporting law is the main control. You can dispute inaccurate or incomplete information, and the company must investigate. Deadlines and remedies depend on the report type and the dispute. Keep your request factual and tied to documents.
Thing is, for general data brokers, the answer is thinner. No single federal law gives you a correction right for every profile. The FTC can act under Section 5 when a broker uses deceptive or unfair practices. It has brought cases over sensitive location data.
A KPMG regulatory alert and a WilmerHale summary describe 2024 FTC actions against brokers such as InMarket Media, Outlogic, Mobilewalla, and Gravy Analytics. Those cases can force data deletion or privacy programs. They do not create a universal consumer dispute portal.
State law may give you stronger rights. Colorado's right-to-correction rule says a controller must correct personal data in existing systems, except archive or backup systems, and it can sometimes tell you to fix the data through your account settings rather than by handling the request directly.
The response window is 45 days, with a possible 45-day extension. Colorado's right-to-correction rule has the details. California has a separate deletion route through the Delete Act, covered below.
How to dispute inaccurate data with a data broker
Start by naming the company and its category. Check the CFPB list for consumer reporting companies. For a marketing or people-search broker, find its privacy or opt-out page.
- Identify the company and its category. Check the CFPB list for consumer reporting companies. For a marketing or people-search broker, find the company's privacy or opt-out page.
- Request your file or report. Start with the CFPB's list if the company is a consumer reporting company. General data brokers may offer access only if state law applies or if their policy allows it.
- Gather focused evidence. Use a government ID, proof of address, a court document, an account statement, or a screenshot showing the error. Send only what the company needs.
- Submit the dispute in writing. Use the company's portal if it has one. If not, send a letter and keep a copy. Say what is wrong, what is correct, and what you want changed or deleted.
- Track the clock. Colorado gives controllers 45 days, plus a possible 45-day extension. California's DROP process uses a 45-day cycle for data broker deletion requests. Credit reporting disputes have their own federal timeline.
- Escalate if the company ignores you. For consumer reporting problems, file a complaint with the CFPB. For a general data broker, try your state attorney general or state privacy agency. California residents can use the California Privacy Protection Agency for Delete Act issues.
California's DROP changes deletion requests
California's Delete Act created the Delete Request and Opt-out Platform, or DROP. Starting August 1, 2026, data brokers must access DROP at least once every 45 days and process consumer deletion requests, subject to limited exceptions. The California Privacy Protection Agency's data broker page explains broker duties.
Consumers must verify California residency before submitting a deletion request through DROP. If the verification service can't confirm you, you can request a review of your residency classification. DROP is a deletion tool, not a general correction tool.
Opt out and correction do different jobs
Opting out and correcting a record are not the same request.
| Action | What it usually does | Main limit |
|---|---|---|
| Opt out | Removes you from sale, sharing, or marketing lists | May be temporary and may not fix wrong data |
| Correction | Fixes inaccurate data in a file or profile | Only where a law or company policy gives you that right |
| Deletion | Removes data under a law like California's Delete Act | Often limited to a state, with verification and exceptions |
Opting out is often faster. It can stop some sales or marketing uses, but it doesn't always correct the underlying record. A correction request targets the error itself. If your credit or employment record is wrong, the consumer reporting route usually matters most.
Evidence, limits, and escalation paths
Keep a paper trail. Save portal confirmations, certified mail receipts, emails, and copies of the incorrect report. If a consumer reporting company won't fix an error, the CFPB is the federal complaint route. For a general data broker, your leverage depends on state law, the company's own policy, and whether the FTC has already taken action against that broker.
To be honest, most disputes come down to paperwork and persistence. Don't assume a data broker must correct every profile just because you ask. For general data brokers, no federal rule creates that duty. You can still ask, document the error, and use the strongest route that applies to your state and the type of company.
Common questions
Do data brokers have to correct inaccurate data? Some do under state laws. Consumer reporting agencies have federal dispute duties. General data brokers often don't have a nationwide correction obligation.
What is the deadline for a data broker correction request? It depends on the law. Colorado's rule gives controllers 45 days, with a possible 45-day extension. California's Delete Act uses a 45-day deletion processing cycle for data brokers.
Can I dispute data with a data broker if I don't live in California or Colorado? You can ask. The company may not have a legal duty to correct your profile. Check your state's privacy law and the broker's own policy.
Should I opt out or dispute? Opt out if you want to stop sales or marketing use. Dispute if the data is wrong and you need it fixed.
Where do I complain about a data broker? For consumer reporting issues, start with the CFPB. For general data brokers, try your state attorney general or state privacy agency. California residents can use the California Privacy Protection Agency for Delete Act issues.
Start with the CFPB list if you're unsure which track applies. It can keep you from sending a request down the wrong path.