How to remove your data from data brokers

If you've ever searched your own name and found a people-search site listing your address, age, relatives and phone number, you've met a data broker. This guide explains where that data comes from and the routes for getting it removed, using official sources checked on November 13, 2026.

What is a data broker?

California's privacy regulator defines a data broker as a business that collects personal information about consumers from various sources and sells it to other companies, even when the consumer never dealt with the business directly (CPPA Data Broker Registry).

The US Federal Trade Commission studied nine data brokers in depth for a 2014 report. It found they gather information from "a wide variety of commercial, government, and other publicly available sources" and also infer things about people, for example that someone with a boating license is interested in boating. They sell three main kinds of products: marketing lists, risk and identity-verification tools, and people-search. Because these companies "generally never interact with consumers, consumers are often unaware of their existence" (FTC, 2014).

People-search sites are the part most people notice, because anyone can look you up. Marketing and risk brokers are less visible but often hold more.

How to opt out of data brokers by hand

Manual opt-out is free and works everywhere, but it's slow, and listings can come back as brokers buy fresh data.

1. Search for yourself Search your full name with your city, and with old addresses and phone numbers. Note every people-search listing you find.
2. Find each site's opt-out page Most brokers have a privacy or "do not sell" page, usually linked in the site footer. California's registry lists registered brokers, with contact details for each (CPPA Data Broker Registry).
3. Use a separate email address Brokers often ask for an email to confirm the request. A throwaway address keeps your main inbox out of their records.
4. Give only what's needed Match the listing's details so they can find it. Don't hand over extra information, such as an ID, unless the law in your state requires verification and you trust the site.
5. Remove search results too Google's "Results about you" tool lets you ask Google to drop results that show your phone number, home address or email address. It only removes the result from Google Search; the page stays online until the site itself removes it (Google Search Help).
6. Check again every few months Set a reminder. Re-listing is common, because brokers keep buying data.

California's Delete Act and the DROP platform

California's Delete Act created a single way to reach every registered data broker at once. The California Privacy Protection Agency, which now calls itself CalPrivacy, runs it as the Delete Request and Opt-out Platform (DROP).

• Who can use it: California residents. You verify through the California Identity Gateway, and the agency says your verification information isn't retained by DROP.
• Cost: free. CalPrivacy says "we will never charge you to use DROP."
• When it opened: January 1, 2026.
• When brokers act: starting August 1, 2026, registered data brokers must download DROP's deletion lists at least once every 45 days and process the requests. It can take up to 90 days for your status to update in DROP.
• Results vary: the agency says deletion may mean fewer targeted ads and possibly less spam, but "Results will vary by consumer."

Sources: CalPrivacy: DROP, CPPA: Data brokers.

Brokers had to register and pay a $6,000 annual fee between January 1 and 31, 2026. From January 1, 2028, they must pass an independent audit every three years (CPPA).

Your right to erasure in the EU and UK

In the EU and UK, the GDPR (and the UK GDPR) gives you a right to have personal data erased, often called the right to be forgotten. The UK regulator, the ICO, explains how it works (ICO):

• When it applies: for example, the organization no longer needs the data, you withdraw consent, you object and your interests outweigh theirs, you object to direct marketing, or the data was used unlawfully.
• Deadline: one calendar month to respond, extendable by two months for complex requests if they tell you why within the first month.
• Exceptions: freedom of expression and journalism, legal obligations to keep data, public-interest tasks, legal claims, and some research and archiving.
• How to ask: contact the organization verbally or in writing; writing is better because it gives you proof. No special wording is needed, and the ICO offers a template.
• If they refuse: complain to the organization, then to your data protection authority (the ICO in the UK, or your national regulator in the EU).

What paid data removal services do

Paid removal services send opt-out and deletion requests to a list of brokers on your behalf, then re-check on a schedule and resubmit when listings return. You pay a subscription and share your personal details with the service so it can find and match your records.

• What you get: time saved, and repeat checks you might not do yourself.
• What to check before signing up: which brokers it covers, how often it re-checks, whether it shows proof of each removal, and its own privacy policy, since you're giving it the very data you want removed.
• What none of them can promise: that data won't come back, or that brokers outside the service's list will act.

Tunnelcheck doesn't rank these services. We haven't found independent, published evidence that would justify a ranking. If you live in California, try DROP first, because it's free and reaches every registered broker by law.

How to give brokers less to work with

• Use a private search engine and a privacy-focused browser to cut down on tracking.
• Use email aliases and a separate phone number for sign-ups and loyalty programs.
• Turn on browser and phone settings that send a "do not sell or share" signal where your state honors it.
• A VPN hides your IP address from sites and your browsing from your internet provider; see what a VPN does. It doesn't remove data brokers already hold.