How to Opt Out of Data Brokers (2026)

Hundreds of companies are profiling and selling your personal data right now without ever asking your permission. You have legal tools to stop them, and the most powerful one in 2026 is free, takes ten minutes, and reaches every registered California data broker at once.

What Is a Data Broker and Why Should You Care?

A data broker is a business that collects personal information about consumers from various sources and sells that information to other companies, without a direct relationship with the consumer whose data is being sold. That definition comes directly from California Civil Code section 1798.99.80, the statute at the heart of the state's DELETE Act.

Data brokers obtain your information from dozens of sources: public records, loyalty card programs, social media activity, smartphone location data, purchase histories, credit headers, and data purchased from other brokers. They combine those inputs to build detailed consumer profiles that get sold to marketers, employers, landlords, private investigators, political campaigns, and in some cases law enforcement agencies and foreign actors.

The California Privacy Protection Agency's data broker registry requires each registered broker to disclose the categories of personal information it collects. The list is striking: Social Security numbers, precise geolocation, health information, browsing history, financial data, biometric identifiers, and information about children all appear. These are not abstract risks. Data broker profiles fuel spam calls, enable stalking, expose people fleeing domestic violence, power discriminatory targeted advertising, and create the raw material for identity theft.

The good news is that the legal landscape shifted meaningfully in 2025 and 2026. California's centralized deletion platform is live. Texas and Oregon now run data broker registries alongside California and Vermont, and Connecticut and New Jersey registries start in 2027. And browser-level opt-out signals now carry legal weight in multiple states. The steps below use every tool currently available.

Step 1: Enable Global Privacy Control in Your Browser

Time required: About five minutes. Reach: 66,000+ participating websites. Legal effect: Legally binding opt-out under California law for covered businesses.

Global Privacy Control is a browser-level signal you enable once. The duty to honor it comes from the CCPA regulations: 11 CCR section 7025(b) provides that a business that sells or shares personal information "shall process any opt-out preference signal" meeting the stated requirements "as a valid request to opt-out of sale/sharing," and section 7025(c)(1) requires the business to treat that signal as a valid opt-out request under Civil Code section 1798.120 for the browser or device. The California Attorney General's CCPA guidance states the same thing. California Civil Code section 1798.135(b) is a companion safe harbor rather than the source of the duty: it says a business is not required to post the "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links if it honors opt-out preference signals. The practical effect for you is the same as clicking "Do Not Sell or Share My Personal Information" on every covered site individually. You do not need to fill out a form, create an account, or identify yourself. The signal does the work automatically.

GPC currently reaches over 66,000 participating websites. It is legally required to be honored as an opt-out signal in California. Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey, and Oregon also require covered businesses to honor a universal opt-out signal such as GPC. Texas and Nebraska take a narrower route: you can use a browser setting such as GPC as your authorized agent to opt out, and covered businesses must generally act on it, with exceptions (for example, if the business cannot verify that you live in the state). Maryland lets a business choose between an opt-out link and honoring such a signal. Virginia's VCDPA does not mandate GPC recognition, so also click "Do Not Sell" links manually on Virginia-regulated sites.

How to enable GPC by browser:

1. Brave: GPC is enabled by default. Confirm it is active under Settings > Privacy and Security.
2. DuckDuckGo (mobile and desktop): GPC is enabled by default. No action needed.
3. Firefox: Go to Settings > Privacy and Security > scroll to "Website Privacy Preferences" > check "Tell websites not to sell or share my data."
4. Chrome or Edge: Install the Global Privacy Control extension from the Chrome Web Store or Edge Add-ons store. The EFF's Privacy Badger and Disconnect extensions also implement GPC and add tracker blocking.

Outside California, several state laws say the signal must reflect your own choice rather than a default setting, so a business might not treat a browser's default-on GPC as a valid request there. Turning GPC on yourself, or confirming it in your browser settings, is the safer course.

Once GPC is enabled, if you live in California, every covered business you visit must halt the sale or sharing of your personal information with no additional steps required. Under the CCPA, businesses must comply as soon as feasibly possible, with a maximum of 15 business days from receipt. They cannot require you to also complete a manual opt-out form.

GPC is the single highest-leverage action for most people because it works passively and continuously across the entire web. Do this step first, then continue with the steps below for data that brokers already hold about you.

Step 2: Use California's DROP Platform

Who can use it: California residents only. Reach: All brokers registered with the CPPA. Status: Consumer submissions accepted since January 1, 2026; broker processing required since August 1, 2026, and that date has passed.

The DELETE Act (Senate Bill 362, signed into law 2023, codified at California Civil Code section 1798.99.80 et seq.) created the most powerful consumer data broker tool in the country: a single request that reaches every registered broker simultaneously. The platform is called DROP (the Delete Request and Opt-Out Platform), and the California Privacy Protection Agency operates it at privacy.ca.gov/drop.

As of January 1, 2026, any California resident may use DROP to submit a single deletion request to all active registered data brokers at once, rather than contacting each broker individually. That is the step that no other state yet offers.

The critical two-part timeline you must understand: DROP is live and accepting consumer submissions now. Registered data brokers were required to begin processing DROP deletion requests starting August 1, 2026, the statutory compliance date under the DELETE Act. That date has passed, so brokers are now required to process and honor DROP deletion requests, including any submitted before that date. If a registered broker has not acted on your request, that is now a live compliance issue you can escalate to the CPPA.

How to submit a DROP request:

1. Go to privacy.ca.gov/drop, the agency's official DROP page, which links to the DROP application. The data broker registry page lists brokers but is not where you sign up.
2. Confirm your California residency. The agency verifies residency through the California Identity Gateway, or through Login.gov if you already have an account, before you can submit.
3. Enter your identifiers. The minimum is your name, date of birth, and ZIP code; adding email addresses, phone numbers, and similar identifiers gives brokers more to match against.
4. Submit and save your 8-digit DROP ID and the date. You need the ID to check your request's status, and the date matters if you need to escalate a broker's non-response.
5. Brokers must access DROP at least every 45 days and process your request within 45 days of receiving it. The agency says a status update can take up to 90 days to appear. If a registered broker still has not acted after that, you can report it through the agency's DROP help form or complaint form.

Your DROP request stays active: you do not need to resubmit it, and brokers must keep deleting your data at least every 45 days. Our California Delete Act and DROP guide explains each status DROP shows and what DROP does not delete.

The CPPA publishes the California data broker registry with details for every registered broker, including business name, categories of personal data collected, and categories of entities to whom data is sold. The 2026 registry (reporting 2025 activities) is the operative list for consumers using DROP; the registry refreshes every January. The CPPA oversees registration, compliance monitoring, and enforcement of the DELETE Act with civil penalty authority under California Civil Code.

If you live outside California, you cannot use DROP. Proceed to Steps 3 and 4.

Step 3: Check Your State's Data Broker Registry

Even if you use DROP, some data brokers operate outside California's registry. And for residents of other states, per-broker registries are the primary research tool for finding which companies hold your data and what opt-out mechanisms they offer.

California CPPA Registry (cppa.ca.gov/data_broker_registry/)

All qualifying data brokers must register annually with the CPPA between January 1 and January 31, reporting their prior calendar year's data practices. The registry lists each broker's business name, contact information, categories of data collected, categories of entities to whom data is sold (including law enforcement, government agencies, GenAI developers, and foreign actors), and statistics on consumer requests received. The registry does not show how brokers handled your DROP request; check that with your DROP ID on the DROP status page, and report a broker that has not acted through the agency's DROP help form or complaint form.

Vermont Secretary of State Registry (legislature.vermont.gov)

Vermont requires data brokers to register annually by January 31 with the Vermont Secretary of State under 9 V.S.A. section 2446. Each registered broker must disclose its opt-out method, which data practices consumers can and cannot opt out of, whether the broker vets purchasers of data, and the number of security incidents. The registration fee is $100. Brokers that fail to register face civil penalties up to $10,000 per year plus unpaid fees, and the Vermont Attorney General may seek injunctive relief. Vermont's Act 138 (signed June 16, 2026) raises the registration fee to $900 per year and adds a $20,000 surety bond and new verification duties, effective January 1, 2027. The $100 fee above is current through the end of 2026.

Vermont's opt-out process is broker-by-broker: there is no Vermont equivalent of DROP. Use the registry to locate each broker, then use its disclosed opt-out method (email, web form, or mail address) to submit your request directly. Vermont consumers may also authorize a third party to submit opt-outs on their behalf under 9 V.S.A. section 2446.

Oregon Department of Consumer and Business Services (oregonlegislature.gov)

Oregon requires data brokers to register with the Oregon Department of Consumer and Business Services under ORS 646A.593. The department has rulemaking authority and may impose penalties for operating without registration. Oregon's broader consumer data rights, including the right to request deletion of personal data, are also found in the Oregon Consumer Privacy Act at ORS 646A.570 through 646A.589. To identify Oregon-registered brokers and locate their opt-out mechanisms, check the DCBS registry and each broker's privacy policy.

Texas Secretary of State Registry (sos.state.tx.us/statdoc/data-brokers.shtml)

Texas requires data brokers to register with the Texas Secretary of State under Business and Commerce Code Chapter 510 (originally enacted as Chapter 509 by SB 2105 in 2023, redesignated Chapter 510 effective September 1, 2025). Registered brokers must disclose their data collection practices and opt-out mechanisms, and pay a $300 annual registration fee. Use the Texas SOS registry to identify which brokers are active in Texas, then use each broker's disclosed opt-out page to submit your request. Since January 1, 2025, the Texas Data Privacy and Security Act has let you designate an authorized agent through a browser setting or extension, such as GPC, to opt out of data sales and targeted advertising (Business and Commerce Code section 541.055(e)). A covered business must comply if it can verify your identity and the agent's authority, but it need not if, for example, it cannot verify that you live in Texas or does not process similar requests it receives under other states' comparable laws.

For a detailed look at how CCPA opt-out rights work alongside these registries, see the CCPA right to opt out of sale and sharing. For a comparison of all major US state privacy laws, see the US state privacy laws comparison.

Step 4: Submit Per-Broker Opt-Out Requests

For data brokers not covered by DROP (including brokers operating outside California's registry and all brokers for non-California residents), you will need to submit opt-out requests directly to each broker using its disclosed mechanism.

How to find each broker's opt-out link:

1. Search the relevant state registry (California, Vermont, Oregon, or Texas) for the broker by name.
2. Look at the broker's registered contact information and disclosed opt-out method.
3. Go directly to the broker's website and look in the footer or privacy policy for a link labeled "Do Not Sell or Share My Personal Information," "Your Privacy Rights," "Opt Out," or "Consumer Privacy Request."
4. Under the CCPA, covered businesses cannot require you to create an account to submit an opt-out request and should avoid demanding burdensome identity verification, though they may ask basic identifying questions to locate your record.

What to include in your request:

Provide your full name, email address, phone number, and any other identifiers the broker is likely to have used to profile you (your city and state, your approximate age if you are comfortable sharing it, and past addresses if you have moved). The more specific you are, the easier it is for the broker to locate your record, and the harder it is for the broker to claim it could not find you.

Prioritize high-risk broker categories first:

• People-search sites (sites that publish name, address, relatives, phone, and background-check summaries): These are the most directly harmful to individuals. Look for sites that appear when you search your own name.
• Marketing data brokers: Companies that aggregate purchase behavior, demographic profiles, and interest segments for ad targeting.
• Data aggregators: Companies that compile comprehensive consumer files from multiple sources and license them to other businesses.

The CCPA response clock: For California-covered businesses, once they receive your opt-out request, they must act as soon as feasibly possible, with a maximum of 15 business days from receipt. After you opt out, the business cannot resume selling or sharing your data unless you provide explicit re-authorization, and it must wait at least 12 months before requesting that re-authorization. Document the date of every request you submit.

The CCPA "Do Not Sell or Share My Personal Information" opt-out right applies to businesses that sell personal information or share it for cross-context behavioral advertising under California Civil Code section 1798.120 and 1798.135. "Sharing" is defined specifically as sharing for cross-context behavioral advertising, meaning targeting you based on online activity across multiple websites. Both the sale right and the sharing-for-ads right are covered by the single "Do Not Sell or Share" mechanism.

Step 5: Escalate If a Broker Ignores Your Request

Most reputable data brokers will comply with opt-out requests, especially from California residents where the legal exposure is clear. Some will not. If a broker ignores your request or delays beyond the statutory deadline without explanation, you have escalation options.

California Privacy Protection Agency

For California residents dealing with California-registered data brokers, the CPPA is your primary enforcement contact. The agency oversees registration, compliance monitoring, and enforcement of the DELETE Act and CCPA with civil penalty authority. Visit cppa.ca.gov to find the agency's contact and complaint mechanisms. DROP non-compliance is now directly actionable, since the August 1, 2026 processing deadline has passed.

Vermont Attorney General

For Vermont-registered brokers that fail to honor opt-out requests or fail to maintain registry compliance, the Vermont AG has civil penalty and injunctive authority under 9 V.S.A. section 2446. File a consumer complaint through the Vermont AG's consumer assistance program.

Oregon Department of Justice

For Oregon-registered brokers, file a consumer complaint with the Oregon DOJ at oregonconsumer.gov. The department coordinates with DCBS on broker registration enforcement.

Texas Attorney General

For Texas-covered businesses that ignore TDPSA opt-out requests or CCPA obligations, the Texas AG's consumer protection division handles privacy complaints. The AG filed the first state privacy enforcement action in the United States against Allstate in January 2025, and the office is actively enforcing.

Federal Trade Commission

File a complaint at ftc.gov/complaint. The FTC does not enforce state privacy laws directly, but it tracks complaint patterns across companies and uses them to prioritize federal investigations under its Section 5 unfair or deceptive practices authority. A well-documented FTC complaint contributes to the public record against repeat offenders.

What to include in any complaint:

Document the date you submitted your request, the broker's name, the response (or lack of response), and any written exchanges. The more specific your documentation, the more useful your complaint is to enforcement agencies.

Step 6: Understand the Limits and Maintain Your Opt-Outs

Data broker opt-outs are not permanent unless you actively maintain them. Understanding the limits of each tool prevents you from assuming protection you do not have.

DROP covers only registered California brokers. Not every data broker is registered with the California CPPA. New brokers register each January. Brokers that operate below the qualifying threshold or that violate the registration requirement may not appear in the registry at all. The DELETE Act gives the CPPA enforcement tools against non-registering brokers, but gaps exist. You do not need to resubmit a DROP request when new brokers register: the agency says all current and future brokers active in DROP are included unless you narrow your request. Checking the registry is still useful for finding brokers that DROP does not reach.

GPC only reaches online interactions. GPC signals apply to covered businesses that process your data through a website or online service. They do not reach offline data collection, data already held before you enabled GPC, or brokers that have no direct online interaction with you. Per-broker opt-outs remain necessary for the full picture.

FCRA-covered entities are a separate category. The three major credit bureaus (Equifax, Experian, TransUnion) and background-check agencies subject to the Fair Credit Reporting Act are not covered by CCPA opt-out or DROP. Their data practices are governed by the FCRA, which gives you separate rights: the right to dispute inaccurate information, the right to place a free security freeze blocking new credit accounts, and annual free credit reports at AnnualCreditReport.com. A security freeze is one of the most effective privacy tools available to any U.S. consumer. Use it alongside data broker opt-outs, not as a substitute for them.

Opt-outs can expire or be reset. Some brokers re-acquire your data from new sources after you opt out and re-profile you. The CCPA's 12-month re-solicitation bar applies to businesses asking for your re-authorization, but it does not prevent brokers from building new profiles from new data sources. Set a calendar reminder to recheck the registries and repeat your per-broker opt-outs every few months. A DROP request does not need to be resubmitted, but you can add new identifiers, such as a new email address or phone number, once every 45 days.

Non-California residents face more friction. Vermont, Oregon, and Texas all have registration laws and some consumer rights, but none yet offer a DROP equivalent. Federal law provides no comprehensive data broker opt-out right as of 2026. The strongest protections remain California-specific.

For a full overview of the California Consumer Privacy Act and its protections, see California Consumer Privacy Act (CCPA). For how state privacy laws compare on data broker obligations, see US state privacy laws comparison.

Related guides

• How to Submit a Data Deletion Request (2026)
• How to File a Data Privacy Complaint (2026)
• US State Privacy Laws Comparison Chart (2026)
• CCPA Opt-Out Rights: Do Not Sell or Share My Personal Information (2026)

Frequently Asked Questions

Can I use the DROP platform if I do not live in California?

No. DROP is available only to California residents under the DELETE Act (California Civil Code section 1798.99.80 et seq., enacted as SB 362 in 2023). If you live in another state, you must use per-broker opt-outs through each broker's disclosed mechanism and any opt-out rights available under your state's privacy law.

When do data brokers have to honor requests submitted through DROP?

Registered data brokers were required to begin processing DROP deletion requests starting August 1, 2026, the statutory compliance deadline under the DELETE Act. That date has passed, so brokers are now required to process and honor DROP deletion requests, including any submitted before that date. If a broker ignores your request now, that is a compliance issue you can report to the CPPA.

Does Global Privacy Control work in every state?

GPC is legally required to be honored as an opt-out signal in California under the CCPA regulations at 11 CCR section 7025, which require a business that sells or shares personal information to process a compliant opt-out preference signal as a valid opt-out request (Civil Code section 1798.135(b) is the related safe harbor that lets a business skip the opt-out links if it honors those signals). Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey, and Oregon also require covered businesses to honor a universal opt-out signal. Texas and Nebraska let you use a browser setting such as GPC as your authorized agent, with exceptions, and Maryland lets a business choose between an opt-out link and honoring the signal. Virginia's VCDPA does not mandate GPC recognition. As a backup, also click the 'Do Not Sell or Share My Personal Information' link manually on important sites, especially those governed only by Virginia or federal law.

Do I have to opt out of every data broker individually?

If you are a California resident, DROP lets you submit one request to all registered California data brokers at once through the agency's DROP platform at privacy.ca.gov/drop. For brokers outside California's registry, or if you live outside California, you must contact each broker separately using its disclosed opt-out method. Vermont, Oregon, and Texas registries help you identify which brokers to contact, but none of those states has a centralized deletion platform equivalent to DROP.

Can a data broker charge me a fee to opt out?

No. California Civil Code section 1798.125(a) bars a business from discriminating against you because you exercised a privacy right, including by charging different prices or rates or imposing penalties. For California's DROP platform specifically, Civil Code section 1798.99.86(b)(5) provides that the accessible deletion mechanism shall not charge a consumer to make a request. One qualifier: section 1798.125(b) still allows a business to offer a financial incentive program for the collection, sale, or sharing of personal information with your prior opt-in consent, so the rule is that you cannot be charged for exercising the right, not that every price difference tied to data is unlawful. You also cannot be required to create an account as a condition of submitting the request.

How long does a CCPA opt-out last?

Under California Civil Code section 1798.120(d), once you opt out, the business is prohibited from selling or sharing your personal information unless you subsequently provide consent. The waiting period comes from a different section: Civil Code section 1798.135(c)(4) requires the business to wait at least 12 months before requesting that you authorize the sale or sharing again. For DROP requests under the DELETE Act, the CPPA's regulations establish an ongoing deletion cycle managed by the agency. Under those rules a DROP request stays active without being resubmitted, and registered brokers must delete your data again at least every 45 days. Brokers outside DROP may still re-acquire data from new sources, so re-checking the registries and repeating per-broker opt-outs periodically is good practice.

What is the difference between a data broker opt-out and a credit freeze?

A credit freeze (security freeze) is governed by the Fair Credit Reporting Act and applies to the three major credit bureaus. It blocks new credit accounts from being opened in your name. Data broker opt-outs cover the broader category of companies selling your personal information for marketing, people-search, advertising, and other non-credit purposes, governed by state privacy laws like the CCPA. You need both for comprehensive protection: a credit freeze to block identity theft through new credit, and data broker opt-outs to stop the sale of your profile for other purposes.

What if I live in a state with no data broker registry?

Most states do not yet have data broker registration laws or a centralized opt-out platform. Your practical options are: enable Global Privacy Control in your browser, which businesses must honor as an opt-out in the states that Step 1 lists as requiring it (the CCPA's rights belong to California residents, and other states' laws protect their own residents); submit per-broker opt-out requests directly through each broker's privacy policy page; and exercise any deletion or opt-out rights available under your state's general consumer privacy law if one exists. Vermont, Oregon, Texas, and California registries are public and can be used by any consumer to identify brokers and locate their opt-out pages even if you lack state-law rights against those brokers.