How to remove yourself from data brokers in 2026

Search your own name on a people-search site and you may find your address, your phone number, your age and the names of people you live with. You never signed up for that site. The information came from a data broker. Getting out takes some work, but in 2026 it is easier than it has ever been, especially if you live in California.

Short answer: to remove yourself from data brokers, California residents can send one free deletion request to every registered broker through the state's Delete Request and Opt-out Platform (DROP). Everyone else opts out broker by broker, using each company's official privacy request page, which the California and Texas data broker registries list. Then cut down on what you give out, so the files don't fill up again.

What is a data broker?

California law defines a data broker as "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." In plain terms, it is a company that sells information about you even though you never bought anything from it.

California's privacy agency, CalPrivacy, says on its data broker registry that brokers collect information "from various sources" and that it may include Social Security numbers, precise geolocation, health-related information and browsing history. People-search sites are the part you can see, but the definition covers any company that sells your information to other businesses.

Some businesses fall outside that legal definition. The California law excludes companies to the extent they are covered by the federal Fair Credit Reporting Act or the Gramm-Leach-Bliley Act, among others. To that extent, those companies are not data brokers under California law, and other rules apply to them.

How to remove yourself from data brokers, step by step

1. If you live in California, use DROP

DROP is the "accessible deletion mechanism" that California's Delete Act required the state to build. CalPrivacy says that since January 1, 2026, California residents can use it to submit one request to all active data brokers asking them to delete their personal information. You make the request on the state's site at privacy.ca.gov/drop.

The law that created it sets out what you get:

• One request covers every registered broker. You do not have to find them one by one.
• It is free. The law says the platform "shall not charge a consumer."
• You can leave brokers out. If you want a particular broker to keep your data, you can exclude it.
• You can check the status of your request, and so can an authorized agent acting for you.
• You can change your request once at least 45 days have passed since your last one.

Brokers have had to act on these requests since August 1, 2026. Each registered broker must check DROP at least once every 45 days and delete your information within 45 days of receiving a request. In practice, allow up to about three months before you judge the results.

Two parts of the law make DROP stronger than a one-time opt-out:

• It keeps working. After a broker deletes your data, it must delete your personal information again at least once every 45 days, and it may not sell or share new personal information about you, unless you ask otherwise or an exemption applies.
• An unverified request still counts. If a broker can't match your request to a record and denies it for that reason, the law says it must treat the request as an opt-out of the sale or sharing of your information instead.

DROP does not reach every company that holds your data. It covers registered data brokers, and the exemptions above still apply. CalPrivacy's FAQ also notes that "personal information does not include publicly available information," such as information lawfully made public in government records.

2. Make a list of the brokers that show your information

If you are outside California, or you want to cover businesses DROP doesn't reach, start with a list. Search your full name with your city, then your phone number, then your current and past addresses. Write down every site that shows a profile of you, along with the profile's web address, since many opt-out forms ask for it.

3. Find each broker's official opt-out page

Don't rely on a link from a search ad. Two state registries list brokers and how to reach them:

• California. The California Data Broker Registry can be downloaded as a spreadsheet. According to CalPrivacy, it includes each broker's website and the web page where consumers can exercise their privacy rights.
• Texas. The Texas Secretary of State keeps a searchable Data Broker Registry. Texas law also requires a data broker with a website or app to post a conspicuous notice on it.

You don't have to live in Texas or California to use these lists to find a company's request page.

4. Submit a deletion request, and an opt-out of sale

Use the method the broker names in its privacy policy. CalPrivacy notes that the designated method may be different from the company's normal customer service contact. Ask for two things: delete the information you have about me, and stop selling or sharing it.

Ask for both because they work differently. A business may deny a deletion request for information it did not collect directly from you. But CalPrivacy says that even then, a business that sells or shares your information must tell you about your right to opt out of that sale.

Give only what the form needs to find your record. If a form asks for far more than your name and address, look for another method the broker accepts.

5. Keep a record and follow up

Note the date, the broker and what you sent. Under California's privacy law, a business must confirm a delete request within 10 business days and answer it within 45 calendar days, with one possible 45-day extension if it tells you. An opt-out of sale must be honored within 15 business days.

Other states use similar deadlines. The Texas Attorney General says companies covered by the Texas Data Privacy and Security Act must respond within 45 days, can extend that by 45 more when reasonably necessary, and must offer a way to appeal a refusal.

6. Check again every few months

Search your name again after the deadlines pass and a few times a year after that. A profile that comes back is worth a new request. In California, DROP's recurring 45-day deletion does this for registered brokers automatically.

Your rights if you live outside California

DROP is California-only, but the right to ask for deletion is not. Several states now have privacy laws that give residents rights over their data. Three examples, from the states' own pages:

Oregon's list right is especially useful here. Asking a company where it sent your data can tell you which brokers to contact next.

These laws apply to businesses that meet each state's thresholds, and each has exemptions. Your state attorney general's website is the place to check whether your state has a law and how to file a complaint if a company ignores you.

Do paid data removal services work?

A paid removal service does steps 2 through 6 for you on a subscription. It works as your authorized agent, which California's law explicitly allows, including inside DROP. Whether one is worth paying for depends on how much of your time it saves and on what it actually covers.

Before you sign up for any of them, ask:

• Which brokers does it cover? Compare its list with the state registries. A long list of small sites matters less than coverage of the ones that showed your profile.
• What does it need from you? It will need some personal details to find your records. Read its privacy policy to see how it stores them and whether it shares them.
• Does it re-check? Profiles can come back, so ask whether it searches again and resubmits.
• Does it show its work? A report of each request and each broker's reply lets you check the results yourself.

If you live in California, use DROP first. It is free and covers every registered broker at once. A paid service can then pick up businesses that DROP doesn't reach.

Stop feeding new files

Removal cleans up information that has already spread. Brokers keep collecting, so the other half of the job is giving out less. Your email address and phone number are the details that link one account to the next, which makes them the place to start.

Give each shop, app and newsletter its own address. With Secria Mail that takes a few seconds, because email aliases are built into the mailbox: 2 on the free plan, 15 on Mail Plus and unlimited on Pro. If an alias starts getting mail from strangers, you know who passed it on, and you can delete it. Secria Mail is free with no phone number and no card, tracking pixels are removed automatically and senders never see your IP address. There are no ads, and Secria never mines your mail.

A dedicated alias is also a good address for the opt-out requests themselves, so brokers don't get your main inbox in return for deleting you. If you want to see how far your address has already traveled, check whether it was in a data breach.

Frequently asked questions

Is DROP free?

Yes. California's Delete Act says the deletion mechanism "shall not charge a consumer" to make a request. Only data brokers pay to access it.

Can I use DROP if I don't live in California?

No. CalPrivacy describes DROP as a tool for California residents. If you live elsewhere, use the manual steps above and the rights your own state's law gives you.

How long does it take for data brokers to remove my information?

Through DROP, a registered broker must check for new requests at least once every 45 days and then has 45 days to delete your data, so allow up to about three months. A direct request under California law must be answered within 45 calendar days, or 90 with an extension. Texas uses the same 45-day window.

Will my information come back after I opt out?

It can, because brokers keep collecting from many sources. In California, DROP requires registered brokers to delete your information again at least every 45 days and not to sell or share new information about you. Elsewhere, search your name a few times a year and send a new request when a profile reappears.

Can data brokers refuse to delete my data?

Sometimes. A business can refuse when it can't verify who you are, when the information is publicly available, or when an exemption applies. A broker that sells or shares your data must still tell you how to opt out of that sale, and in California an unverified DROP request is treated as an opt-out.

Removal takes an afternoon, and the follow-up takes a few minutes every few months. To stop handing out the details that rebuild these files, start with a free Secria account.