How to stop companies from selling your data

Many apps, stores and websites pass what they learn about you to other companies, often for advertising. In much of the US you now have a legal right to tell them to stop, and on most phones and browsers you can send that message once instead of site by site. Here is how to use both.

Short answer: to stop companies from selling your data, turn on Global Privacy Control in your browser, which covered businesses in states like California, Connecticut and Oregon must treat as an opt-out of sale. Use the "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link on sites you use often. On an iPhone, turn off Allow Apps to Request to Track. On Android, delete your advertising ID.

What "selling your data" means

Under state privacy laws, a sale is broader than a cash deal. California's opt-out also covers sharing your information for cross-context behavioral advertising. Connecticut and Oregon give the right to opt out of targeted advertising alongside sale. So an opt-out can matter even for a company that doesn't charge anyone for your data.

Your right to opt out, by state

Several states now give residents a right to opt out of the sale of their personal data. Here is what three of them say on their own official pages.

Sources: CalPrivacy FAQ, Connecticut Attorney General, Oregon Department of Justice.

A few details make these rights more useful:

• There is a deadline. In California, a business must honor an opt-out as soon as feasibly possible, and within 15 business days at most.
• It sticks. CalPrivacy says businesses cannot sell or share your information after they receive your opt-out unless you later consent.
• You can't be punished for it. California's law includes a right to equal treatment, so a business can't discriminate against you for using your rights.
• Someone can do it for you. Connecticut says a consumer can designate a third party to opt out on their behalf.
• You can appeal. Connecticut gives you the right to appeal a refusal, and the business has 60 days to answer.

These laws apply to businesses that meet each state's thresholds, and each has exemptions. If your state isn't listed here, check your attorney general's website for a consumer privacy law.

How to stop companies from selling your data, step by step

1. Turn on Global Privacy Control

Global Privacy Control, or GPC, is a setting in your browser or a browser extension. Its official FAQ describes it as a way for "Internet users to notify businesses of their privacy preferences, such as whether or not they want their personal information to be sold or shared." Once it is on, every site you visit receives your opt-out automatically.

Some browsers have GPC built in, and a few turn it on by default. Others need an extension. The GPC website keeps a list of the browsers and extensions that support it, so start there and turn on the setting in the one you use.

Know what GPC does and doesn't do:

• On its own, it is only a request. GPC's FAQ says the signal "on its own does not create any legally binding obligations." The legal force comes from state laws like the three above.
• It doesn't stop collection. Oregon's DOJ says that once you activate the signal, businesses cannot sell your data or use it for targeted advertising, "although the business may still collect and keep it themselves."
• It works per browser. Turn it on in each browser you use, on your phone as well as your computer.

2. Use the opt-out link on sites you use often

CalPrivacy says that in most cases, businesses that sell or share personal information must put a link labeled "Do Not Sell or Share My Personal Information," "Your Privacy Choices" or "Your California Privacy Choices" in the header or footer of their website. Connecticut requires a similar link on websites and in mobile apps.

GPC covers your browsing. The link covers the rest. Use it for companies that hold your data from purchases, loyalty programs or accounts, such as your bank, phone carrier, stores and streaming services. CalPrivacy says the link must let you opt out with that business, so it works no matter which device you used.

If you can't find the link, CalPrivacy suggests reading the company's privacy policy to see whether it sells personal information. If it does, the policy must include the opt-out link as well.

3. Stop apps tracking you on an iPhone

Apple's App Tracking Transparency lets you decide whether an app can track your activity across other companies' apps and websites for advertising or for sharing with data brokers. To refuse for every app at once:

1. Open Settings.
2. Tap Privacy & Security, then Tracking.
3. Turn off Allow Apps to Request to Track.

Apple says that with this setting off, every app that asks is treated as if you tapped Ask App Not to Track. The app developer can't access the system advertising identifier (IDFA) and is not permitted to track your activity using other information that identifies you, like your email address. The same Tracking screen lets you withdraw permission from apps you allowed earlier.

4. Delete your advertising ID on Android

Android apps can use your device's advertising ID to personalize ads. Google's Android Help gives the path to its controls:

1. Open your device's Settings app.
2. Tap Google, then All services.
3. Under "Privacy & security," tap Ads.

From there you can reset or delete the ID. Deleting is the stronger choice. Google's My Ad Center Help says deleting removes the advertising ID and doesn't assign a new one, while resetting just replaces it with a new ID. Google also notes that apps may have their own settings that use other types of identifiers, so check the privacy settings inside apps you use a lot.

5. Give out less to begin with

Opt-outs control what happens to data a company already has. The details you never hand over are the ones no company can sell. When a form asks for more than the service needs, such as a phone number or birthday for a newsletter, leave the optional fields blank. For the tracking settings in your Google account, see how to stop Google from tracking you.

Your email address connects everything

Opt-outs and phone settings deal with ad identifiers. Your email address is often an identifier too. It is the one detail you give to nearly every store and app, which makes it easy to connect your accounts to each other. Apple's own tracking rules list the email address as information that can identify you.

Using a different address for each service breaks that link. Secria Mail has email aliases built into the mailbox, so each site can get its own address: 2 on the free plan, 15 on Mail Plus and unlimited on Pro. If an alias starts getting mail from companies you never gave it to, you know who passed it on, and you can delete it.

In the inbox itself, tracking pixels are removed automatically and senders never see your IP address. There are no ads, and Secria never mines your mail. Secria Mail is free with no phone number and no card. More on how the pixels work in how to stop email tracking.

If your details are already out there, our guide on how to remove yourself from data brokers covers the cleanup.

Frequently asked questions

Can I legally make companies stop selling my data?

In states with a consumer privacy law, yes. California, Connecticut and Oregon all give residents the right to opt out of sale, and covered businesses must honor it. California, Connecticut and Oregon also require covered businesses to treat an opt-out preference signal like Global Privacy Control as a valid opt-out.

Does Global Privacy Control work if my state has no privacy law?

Your browser still sends the signal to every site, and some businesses may choose to honor it. GPC's own FAQ says the signal does not create legal obligations on its own, though, so where no law requires it, honoring it is up to each company.

Does opting out delete my data?

No. An opt-out of sale stops a company from selling or sharing your data, but it can still keep it. To have it removed, send a separate deletion request through the method in the company's privacy policy. California businesses must answer a deletion request within 45 calendar days, with one possible 45-day extension.

Do I have to opt out of every website separately?

Not if you use GPC. In states that require businesses to honor it, the signal sends your opt-out to every covered site you visit in that browser. Use the "Do Not Sell or Share" link for companies that hold your data from accounts or purchases.

Does Ask App Not to Track stop all tracking on my iPhone?

It stops the app from using Apple's advertising identifier and, by Apple's rules, from tracking you across other companies' apps and websites with other information that identifies you, such as your email address. It is about tracking across other companies' apps and websites, so it does not cover what an app does with the information you give it inside the app itself.

Is deleting my Android advertising ID enough?

It removes one identifier. Google says you may still see ads based on other factors, like information you have shared with apps, and that apps may use other types of identifiers. Combine it with GPC in your browser and the opt-out links on companies you use often.

Ten minutes with these settings sends a standing opt-out to most of the companies you deal with. To stop one address from linking all of them, start a free Secria account.