Personal Data Removal: Data Broker Opt Outs Guide

Data brokers and people-search sites publish home addresses, phone numbers, relatives and past addresses for almost anyone, and that profile is the raw material for stalking, doxxing, phishing and account takeover. This guide is for any individual who wants to shrink that footprint, and for the security, privacy and HR teams who advise staff on doing it. It covers the three routes that actually remove data: manual opt-outs on each site, law-based requests (the California Consumer Privacy Act, California's Delete Request and Opt-out Platform, and UK and EU GDPR rights), and paid removal services, with how to choose between them and how to tell whether it is working. Programmes run for named executives on behalf of an organisation have their own consent, scoping and travel issues, covered in the Executive Protection and Digital Footprint Guide; this page stays with what one person can do for themselves and their household.

Practice recommendations in this guide (removal plan, rollout timings, metrics and targets) are NHI Mgmt Group recommendations; regulatory and incident details are attributed to the sources linked in the text, as checked in November 2026. Confirm against the official text before relying on it.

Key takeaways

Use the strongest legal route first. A California resident can send one free deletion request to every registered data broker through DROP; UK and EU residents can demand erasure and object to direct marketing, with a one-month response deadline.
Manual opt-outs still matter. Brokers outside a registry, and sites outside the reach of your local law, only respond to their own opt-out forms, and records reappear after new data feeds arrive.
Removal services are a convenience, not a guarantee. Consumer Reports found in 2024 that the best of seven paid services removed 68% of profiles after four months, while volunteers doing manual opt-outs removed about 70% within a week.
Search delisting is not deletion. Google's Results about you can hide results showing your address, phone or email, but the page stays on the source site until the site removes it.
Treat it as maintenance. Keep a request log with dates, routes and reference numbers, re-check on a schedule, and pair removal with credit freezes and stronger account recovery so that what remains public is harder to abuse.

What data brokers hold and why it is a security problem

California's regulator defines a data broker as a business that knowingly collects and sells the personal information of consumers it has no direct relationship with. People-search sites are the most visible kind: they assemble public records, marketing lists, old directory data and scraped social profiles into one page per person, usually free to view in summary and paid for in full. Marketing list brokers and risk data brokers sit behind them and are less visible, but feed the same profiles.

For an attacker this is cheap reconnaissance. MITRE ATT&CK describes it as Gather Victim Identity Information (T1589) and Search Open Websites/Domains (T1593): names, email addresses, phone numbers and relationships collected before phishing for information (T1598) or a social engineering call to a help desk or mobile carrier. A broker profile answers the questions that knowledge-based verification and account recovery still ask: previous addresses, relatives' names, date of birth ranges and old phone numbers.

Data typically listed	How it is misused	Removal priority
Current home address	Stalking, harassment, doxxing, physical threats, parcel and mail fraud	Highest
Mobile number	SIM swap targeting, smishing, voice phishing, account recovery abuse	Highest
Personal email addresses	Phishing, credential stuffing, password reset abuse	High
Relatives and household members	Pretexting ("I am calling for your son"), targeting family as a route to you	High
Previous addresses and phone numbers	Answers to knowledge-based verification questions	Medium
Age, employer, education	Spear phishing pretexts, impersonation	Medium

See the Doxxing Prevention Guide for the wider picture of how exposed personal details are used against people, and how to respond when it happens.

The three removal routes compared

No single route covers everything. The right mix depends on where you live, how many sites list you and whether you are at elevated risk.

Route	Reach	Cost and effort	Strengths	Limits
Site-by-site opt-out forms	Any site that offers a form, anywhere	Free; hours of effort, repeated	Fast when it works; you control what identifiers you share	Records return after new data loads; each site has its own process
California DROP	All brokers registered in California, for California residents	Free; one verified request	One request reaches over 600 registered brokers; brokers must keep processing on a 45-day cycle	Only registered brokers and California residents; limited exceptions apply
CCPA requests to individual businesses	Businesses covered by the CCPA, for California residents	Free; one request per business	Rights to know, delete, correct, limit and opt out of sale or sharing, with statutory deadlines	Covers California consumers only; exceptions for legal retention
UK and EU GDPR requests	Any controller processing your data under UK GDPR or the EU GDPR	Free; one request per organisation	Erasure, objection to direct marketing and access rights, one-month deadline, regulator complaint route	Exemptions for journalism, legal obligations and legal claims; enforcement against offshore sites is hard
Paid removal service	The list of sites the service supports	Subscription; low personal effort	Repeated scans and resubmissions without your time	Variable effectiveness; the service holds your identifiers; coverage lists differ
Search engine delisting	Search results only	Free	Reduces casual discovery of the profile	The source page remains online

California: DROP and CCPA requests

DROP for every registered broker

The Delete Act created the Delete Request and Opt-out Platform (DROP), run by the California Privacy Protection Agency. As described on the agency's DROP page (checked November 2026):

Who: any California resident. Residency is verified through the California Identity Gateway; no account is needed, and Login.gov can be used.
Cost: free. The agency states it will never charge consumers to use DROP.
Timeline: requests opened on 1 January 2026. From 1 August 2026 registered brokers must access DROP at least once every 45 days and process deletions, and the agency expected all brokers to finish their first download and upload cycle by November 2026.
Status: it can take up to 90 days for a request's status to update in DROP, and timing varies by broker.
Family: a request can be submitted for another California resident, such as a parent for a child or a family member for an elderly relative.
Coverage: brokers register each January and pay an annual fee, so DROP reaches the registered population; a business that meets the definition but has not registered still needs a direct opt-out.

See the California Delete Act and Data Broker Registration Guide for the broker-side obligations, audits and penalties.

CCPA requests to individual businesses

For businesses that are not registered brokers, such as a retailer, an app or a marketing platform you dealt with directly, the CCPA rights apply. The California Attorney General's CCPA page sets out:

Rights: to know what is held (covering the previous 12 months, free up to twice a year), to delete, to correct, to limit use of sensitive personal information, and to opt out of the sale or sharing of personal information.
Deadlines: 45 calendar days for know, delete and correct requests, extendable by a further 45 days with notice; opt-out requests as soon as feasibly possible and no later than 15 business days.
Methods: the privacy policy must say how to submit requests; businesses must offer at least two methods for know, delete and correct requests (an email address is enough for online-only businesses), and cannot require you to create an account.
Global Privacy Control: a browser signal (built into some browsers, or added by extension) that covered businesses must honour as a valid opt-out of sale or sharing for data collected online.
Authorised agents: you may authorise a person, or a business entity registered with the California Secretary of State, to submit requests for you; the business can ask for proof of signed permission or confirm with you directly. This is the legal basis on which removal services act for California residents.

See the CCPA and CPRA guide for the full law.

UK and EU: erasure and objection requests

Under UK GDPR and the EU GDPR there is no broker registry or single platform, so requests go to each organisation. The ICO and the European Data Protection Board describe the same core rights:

Right to erasure (Article 17): applies where the data is no longer needed, consent is withdrawn, you object and your interests outweigh theirs, you object to direct marketing, or the processing is unlawful.
Right to object (Article 21): for direct marketing you can object without giving reasons and processing for that purpose must stop. Since most people-search and list brokers sell data for marketing or relying on legitimate interests, an objection combined with an erasure request is usually the strongest letter.
Right of access (Article 15): ask what they hold, where they got it (the source, if not from you) and who they sold it to. The source answer tells you which upstream broker to target next.
Deadline: one calendar month, extendable by two further months for complex requests if the organisation tells you within the first month. The clock starts once any identity information it reasonably asks for is received.
Cost: free, unless the request is manifestly unfounded or excessive.
Exemptions: freedom of expression and journalism, legal obligations, public interest tasks, legal claims and archiving. Newspaper articles and statutory registers usually stay.
Escalation: complain to the organisation first, then to the ICO or your national data protection authority.

In the UK, also opt out of the open version of the electoral register through the register to vote service. GOV.UK states that anyone can buy the open register, that opting out does not affect your right to vote, and that your details stay on the full register, which cannot be bought in the same way. People at risk can apply to register anonymously. See the GDPR Compliance Guide for Security Teams for how organisations handle these requests.

Other jurisdictions and registries

Vermont: data brokers must register annually, between 1 and 31 January, with the Secretary of State. Registration does not by itself give individuals a deletion right, but filings help identify which brokers to approach.
Texas: the Secretary of State keeps a searchable central Data Broker Registry. The Secretary of State is a filing office only and does not enforce broker practices, so use the registry as a target list and the broker's own opt-out for removal.
Other US states: several states have comprehensive privacy laws with deletion and opt-out rights. Check your state's attorney general or privacy regulator site for current rights; they change often.

Choosing a removal service

Paid services scan a list of people-search sites, submit opt-outs or authorised agent requests, and re-check. The Consumer Reports study published on 8 August 2024 tested seven services with 32 volunteers against 13 people-search sites over four months. The best service reached 68% removal at four months; in the first week services ranged from 0% to 58.7%, against about 70% for manual opt-outs. Every participant's information still appeared on at least some sites at each checkpoint. Consumer Reports used the results to call for a federal opt-out right and for more states to copy California's Delete Act.

The lesson is not that services are useless: they save time and handle re-listing. It is that you should verify what they report. Before subscribing, ask:

Question	Why it matters
Which sites are covered, by name, and how often are they re-scanned?	Coverage lists vary and a high site count can include low-traffic sites
Does it show per-site evidence (submission date, confirmation, re-check result)?	Lets you verify removal instead of trusting a dashboard total
What identifiers does it need, where are they stored and for how long?	You are giving a third party exactly the data you are trying to remove
Does it act as an authorised agent under the CCPA, or submit GDPR requests?	Legal requests carry deadlines; web form opt-outs do not
Does it reuse, sell or share the identifiers it receives?	Should be excluded in its privacy policy and terms
How do you cancel, and is your data deleted when you do?	Exit terms show how seriously it treats your data

Give the service the minimum identifiers it needs. A dedicated email address for removal correspondence keeps broker replies, and any marketing that follows, out of your main inbox.

A step-by-step removal plan

Prepare: create a separate email address for requests and a simple log (site, date found, route used, date sent, reference, deadline, outcome). Decide which identifiers you will share; do not send identity documents unless a legal process requires them, and then redact what is not needed.
Baseline: search your name with city, phone number and email on major search engines and the largest people-search sites. Record each listing and screenshot it. Turn on search monitoring such as Google's Results about you if available to you.
Use the bulk legal route: California residents submit a DROP request. In the UK, opt out of the open register.
Send targeted legal requests: to each site and broker you found, send an erasure and objection request (UK and EU) or a deletion and opt-out request (California), citing the right and the deadline. Ask for the source of the data so you can follow it upstream.
Use opt-out forms for everything else: sites outside your law's reach usually have a form. Some ask you to confirm by email or phone; use your dedicated contacts.
Delist from search: request removal of results showing your address, phone number or email. Google states that removal does not delete the information from the source page and that pages from government, education and news sites are generally refused.
Verify and escalate: after the deadline (one month, 45 days or 15 business days), re-check each listing. Chase non-responses in writing, then complain to the ICO, your national authority or the California Attorney General.
Repeat: re-check quarterly, and straight away after moving house, changing number or any public attention. Add newly found sites to the log.

Where identity fits

Removal reduces what an attacker knows, but some of your data will always be public. Make that residual data less useful by changing how your accounts are verified and recovered:

Credit: freeze your credit files so a broker profile cannot be turned into new credit. See the Credit Freezes and Fraud Alerts Guide.
Mobile account: add a carrier PIN or port-out protection, since a published number is the starting point for SIM swap fraud.
Sign-in: move important accounts to passkeys and away from SMS codes and security questions whose answers are on broker sites. See the Passkeys for Everyone Guide.
Recovery: make sure email and phone recovery options are current and not ones listed on old broker records.

Detection and measurement

Treat the footprint as something you can count. For a household or a staff privacy programme, track:

Active listings: number of sites showing your current address or phone, measured at baseline and each re-check. The trend matters more than any single count.
Request closure rate: share of legal requests answered within the statutory deadline, and share that resulted in removal.
Time to removal: median days from request to confirmed removal, per route.
Reappearance rate: share of removed listings that come back within 90 days, which tells you how often to re-check.
Search exposure: results on the first page of a name and city search that show contact details.
Escalations: complaints made to a regulator and their outcome.

Framework mapping

Framework	Reference	Relevance
MITRE ATT&CK	T1589 Gather Victim Identity Information; T1589.002 Email Addresses	Broker profiles supply identity information collected in reconnaissance
MITRE ATT&CK	T1593 Search Open Websites/Domains; T1593.001 Social Media	People-search and social profiles are open sources searched by attackers
MITRE ATT&CK	T1598 Phishing for Information	Profiles make pretexts and voice phishing more convincing
UK GDPR and EU GDPR	Articles 15, 17 and 21	Access, erasure and objection rights used in requests
CCPA (as amended by CPRA)	Rights to know, delete, correct, limit and opt out	Requests to businesses covered by the law, including through authorised agents
California Delete Act	DROP and the data broker registry	One request to all registered brokers

Common failure patterns

One pass and done: people opt out once, then find the same listings a few months later. Every route above, including services, needs scheduled re-checks.
Oversharing to remove data: sending a full identity document, date of birth and every past address to a small site in order to prove who you are. Give the minimum needed to locate the record.
Confusing delisting with deletion: a removed search result feels like success, but the profile is still one click away on the broker site.
Trusting a dashboard total: accepting a service's "removed" count without spot-checking the sites yourself, despite tested removal rates well below 100%.
Ignoring the household: removing your own record while relatives' profiles still list your address. Family members need their own requests, and a parent can act for a child.
Removing data but leaving recovery weak: security questions, SMS recovery and no carrier PIN keep the old exposure exploitable.

Practitioner checklist

Set up a dedicated email address and a request log before sending anything.
Run a baseline search and record every listing with a screenshot.
Submit a DROP request if you are a California resident; opt out of the open register if you are in the UK.
Send erasure and objection (UK and EU) or deletion and opt-out (California) requests to each broker found, asking for the data source.
Use site opt-out forms for everything outside your law's reach.
Request search delisting for results showing your address, phone or email.
Escalate non-responses after the deadline to the regulator.
If you use a removal service, check its site list, evidence reports and data handling, and spot-check its results.
Freeze credit, add a carrier PIN and move key accounts to passkeys.
Re-check quarterly and after any move or change of number.

Personal Data Removal: Opt Outs, Legal Requests and Removal Services