">

A sample data broker complaint letter is a dated request you send to a company that collects and sells personal details about you. You ask them to delete the record or stop selling it.

Want it gone from a people-search page that still shows your old phone number? Start with the broker's own form. Then put the same ask in writing you can prove.

The letter is not a lawsuit or a refund claim. It is evidence that you asked, when you asked, and what you attached.

California residents also have a state deletion list that can reach many registered brokers at once. Use that too if you qualify. One pasted template will not cover credit files, hospitals, or every random website.

What a complaint letter can actually do

It builds a paper trail with a date on it, which is what a regulator will ask for later. Keep copies.

Sample data broker complaint letter template

Here's a draft you can copy. Replace every bracket. Stay factual. Leave out damage claims you cannot back up.

[Your full name]
[Your mailing address]
[City, State ZIP]
[Email]
[Phone]
[Date]

[Data broker legal name]
[Privacy or legal department]
[Address from the broker's privacy policy]

Re: Request to delete personal information and opt out of sale or sharing

Dear Privacy Team:

I am writing to request that you delete the personal information you maintain about me and that you opt me out of the sale or sharing of that information.

I believe you hold records that include some or all of the following:
[name]
[current or former addresses]
[email]
[phone]
[any profile or record ID you found]
[URL or description of the listing]

I am a resident of [state]. Please treat this as a verifiable consumer request under the privacy law that applies to me, including the California Consumer Privacy Act if I am a California resident.

Please delete my personal information from your systems, subject to any legal exceptions you must keep. Stop selling or sharing my personal information. Notify any service providers you are required to tell. Send written confirmation to the email and address above.

I am attaching [screenshots / prior request dates / the minimum ID the broker requires for verification].

If I do not receive a response within the time your privacy policy or applicable law allows, I intend to follow up with the relevant regulator and to keep copies of this request.

Sincerely,
[Your name]

Email the address in the privacy policy if they publish one. Certified mail still helps when you need a date stamp later.

Don't paste a Social Security number unless that broker's verification steps truly require it. Most marketing-broker letters don't.

Which rule applies before you hit send

The letter only works if you aim it at the right process.

| Situation | What usually controls it | What to send | | California resident, marketing or data-broker files | CCPA/CPRA rights, plus the Delete Act DROP list | A DROP request, and a broker letter if a listing remains | | A people-search or marketing profile | The broker's privacy policy, plus your state's privacy law if you have one | An opt-out or deletion request to that broker | | A credit report, or data used for credit, insurance, or employment | Fair Credit Reporting Act dispute rules | A specific dispute, not a generic "delete me" rant | | A documented request the broker ignored | A regulator complaint, not a fifth angry letter | An FTC or state attorney general report, with proof | | You are in the EU or UK and the broker is in scope | A GDPR erasure request to their data protection officer | A separate letter. Don't mix it into a U.S. template. |

U.S. readers should not drop GDPR Article 17 into a letter to a U.S. marketing broker just because a template online said so. If you don't have an EU tie, it muddies the ask.

Thing is, one brand name can sit under two rules. Marketing data and a credit file are not the same request.

Steps to send the letter so it counts

  1. Capture the listing. Save the URL, the date, and a screenshot that shows your name on the broker's site.
  2. Read the privacy policy. Use their official request form if they have one. Many brokers park free-form email when a portal exists.
  3. Fill the template. Name the data points you actually found. Don't claim HIPAA or "FTC damages" unless you know that law applies.
  4. Send two ways if you can: the portal or privacy email, plus certified mail to the address in the policy.
  5. Calendar the follow-up. California deletion processing is often discussed in 45-day windows. Credit disputes follow a different clock. Don't mix those clocks.

Keep a folder. One PDF of the letter, one of the receipt, one of the screenshot.

If you live in California, use DROP first

The Delete Request and Opt-out Platform (DROP) is the state tool for sending one deletion request to registered data brokers.

As of January 1, 2026, California residents can submit through DROP after they verify residency. Keep the confirmation. Data brokers on the registry must begin processing those requests on August 1, 2026, and they must check the accessible deletion mechanism at least once every 45 days. That cycle is not instant.

Turns out a letter to one broker does not replace that list if you are a California resident trying to hit every registered broker at once. DROP is built for that sweep. A letter still helps for a broker that is not in the registry, a listing that remains after the processing window, or a company that is not operating as a data broker under the Delete Act.

You might still write a letter anyway because you found one ugly listing on a specific domain and you want that URL gone this month, not after the next 45-day broker pull, and that's a reasonable instinct even if the state platform is the broader tool.

The California Data Broker Registry shows who registered. The CPPA data broker page and the state's DROP overview explain the consumer side. Status in DROP can take up to 90 days to update, according to California's own notes. Exceptions exist. Brokers are not required to wipe records they must keep for another law.

Don't treat DROP as a wipe of the whole internet. People-search sites, credit bureaus, and some background vendors can sit outside that bucket.

What to do if the broker ignores you

Skip five versions of the same threat. Send one follow-up after the stated deadline. Then switch to a regulator file.

Agencies want a story they can check: the URL, the date you asked, the date they should have answered, and what you still see.

Use this folder when you escalate:

File with the FTC if the conduct looks deceptive or they blew off a clear request. File with your state attorney general for state privacy law. California residents can look to the California Privacy Protection Agency for Delete Act and CCPA issues. None of those filings pays you automatically.

A second letter that demands "$750 per violation" because a blog said so is a weak exhibit. California's private lawsuit path is mainly for certain data breaches, not every ignored opt-out.

Credit reports are not people-search pages

If the problem is an Experian credit file, an error on a loan, or a report used for insurance or work, use the FCRA path. Name the account. Name the error.

Experian's privacy page describes deletion, correction, and opt-out rights for personal information it maintains. Those rights still depend on which Experian product holds the data. Credit-file Experian and marketing-data Experian can sit under different rules, different forms, different waiting periods. People mix them up constantly.

To be honest, a generic cease-and-desist pasted into a credit-file fight often gets parked as incomplete. If a lender or other furnisher put wrong data on your file, you can also dispute that information with the furnisher under the CFPB's direct dispute rule.

HIPAA usually does not control a commercial data broker. Covered health providers and health plans are a different universe. Don't cite a medical privacy rule in a people-search letter unless you actually have that relationship.

Pick one listing tonight. Save the screenshot. Send the broker request, and submit DROP too if you are a California resident. Then mark the follow-up date on a calendar and stop rewriting the same letter.