State privacy laws are the primary legal mechanism that lets you demand data brokers delete your personal information. They work through four core tools: registration requirements (so you can find which brokers hold your data), deletion and opt-out rights (so you can legally demand removal), centralized portals (so one request reaches many brokers at once), and enforcement powers (so regulators can fine brokers who ignore you).
Here is what those tools look like in practice:
- Registration/registry: Brokers must list themselves with a state agency, creating a public directory you can search.
- Deletion right: You submit a request; the broker must delete your data within a statutory window.
- Opt-out right: You tell a broker to stop selling your data, even if they keep it on file.
- Centralized portal: One submission routes to all registered brokers simultaneously (California’s DROP is the clearest example).
- Enforcement: State attorneys general can audit, fine, and sue noncompliant brokers; a few states also let you sue directly.
California’s Delete Act (SB 362) and its DROP platform are the most advanced implementation of these tools in the U.S. right now. If you live in California, you can use DROP today. If you live elsewhere, your rights depend heavily on your state.
Key Takeaways
State privacy laws create the legal routes for broker removal, but California’s DROP is the only centralized portal in the U.S. that routes a single deletion request to all registered brokers simultaneously, with enforcement backed by CalPrivacy.
| Point | Details |
|---|---|
| California leads with DROP | DROP routes one deletion request to all registered brokers; processing begins August 1, 2026. |
| Rights vary by state | Most states offer deletion or opt-out rights, but only California has a centralized portal; everywhere else is broker-by-broker. |
| Exemptions limit coverage | FCRA, GLBA, HIPAA, and public-records carve-outs exclude large data categories from deletion obligations. |
| Re-listing is the norm | Deleted records typically reappear within 3–6 months; one-off requests are not a permanent fix. |
| Monitor after you remove | Combine legal deletion requests with ongoing monitoring to catch re-listed records and unregistered brokers. |
Ready to go deeper? The Techstacktoday guide on whether a data removal service is worth it walks through exactly when paid monitoring earns its cost versus when the DIY route is enough.
Not sure which privacy tools actually protect you? Techstacktoday reviews and ranks data removal services, VPNs, and identity protection tools based on real-world testing, not paid placements. Start with our data removal service guide to find the right level of protection for your situation.
Table of Contents
- How do state privacy laws actually enable broker removal?
- California’s Delete Act and DROP: the model that other states are watching
- How do other states compare on broker removal rights?
- What are the real limits on broker removal requests?
- How to use state rights and tools to remove your data right now
- Why centralized portals outperform registry-only laws
- How enforcement works and whether you can sue a data broker
- The gap between what state laws promise and what they deliver
- Sources
How do state privacy laws actually enable broker removal?
The role of state privacy laws in broker removal comes down to three things: visibility, obligation, and remedy. Without a registration requirement, you cannot even identify which brokers hold your data. Without a deletion right, you have no legal lever to force removal. Without enforcement, brokers can ignore requests with no consequence.
Registration requirements create visibility. States like Vermont, California, Oregon, and Texas require data brokers to register annually with a state agency, pay a fee, and disclose the categories of data they collect. That registry becomes a public list you can search. Data-broker statutes typically require annual registration, disclosures, fees, and obligations to honor consumer deletion requests; newer statutes expand definitions to capture API licensing and other distribution models that older laws missed.
Deletion and opt-out rights create obligation. A deletion right means the broker must erase your record. An opt-out right means the broker must stop selling your data, though they may retain it internally. The practical difference matters: if your goal is to stop your home address from appearing on people-search sites, a deletion right is stronger. If your goal is to stop targeted advertising, an opt-out right may be enough.
Disclosure requirements tell you what categories of data a broker holds, which helps you decide whether to request deletion or opt-out. Statutory exemptions, however, carve out significant categories. The FCRA protects credit-reporting data; GLBA covers financial data; HIPAA covers health records; and most states exempt publicly available information from deletion obligations.
| Mechanism | What it gives you | Key limitation |
|---|---|---|
| Registration/registry | A searchable list of brokers | Incomplete; many brokers don’t register |
| Deletion right | Legal demand to erase your record | Exemptions (FCRA, GLBA, public records) |
| Opt-out right | Stop sale of your data | Broker may still retain the data |
| Centralized portal | One request reaches many brokers | Only covers registered brokers |
| Enforcement/penalties | Regulator can fine noncompliant brokers | AG-only in most states; few private suits |
A 50-state view confirms that many states now have deletion or opt-out rights through broad privacy laws even where they lack broker-specific registration statutes, meaning your rights depend heavily on where you live.
California’s Delete Act and DROP: the model that other states are watching
California’s SB 362, signed in 2023, is the most consequential broker-removal law in the U.S. It builds on the foundation of the CCPA and CPRA, which gave California residents the right to know, delete, and opt out of the sale of their personal information. SB 362 goes further by requiring all data brokers doing business in California to register with the California Privacy Protection Agency (CalPrivacy) and to process deletion requests submitted through a single state-operated platform called DROP.
What DROP does for you
DROP is a California-administered platform that lets you submit a single deletion request distributed to all registered data brokers at once. CalPrivacy operates it, and registered brokers must process every DROP request they receive. CalPrivacy can audit brokers and impose fines for noncompliance.
Here is the consumer flow, step by step:
- Go to the DROP consumer portal at Consumer and create an account.
- Verify your identity using the information the portal requests (name, address, date of birth, and a government-issued ID in some cases).
- Submit your deletion request. DROP routes it automatically to every broker registered in California.
- Wait for broker acknowledgment. Registered brokers must begin processing DROP requests starting August 1, 2026.
- Track responses. Brokers must delete your data within the statutory window; CalPrivacy’s portal lets you monitor status.
- Escalate if a broker ignores the request. File a complaint with CalPrivacy; the agency can audit and fine noncompliant brokers.
🗓️ Key date: Brokers registered in California must begin processing DROP requests on August 1, 2026. If you submit before that date, your request is queued for processing on that date.
The registration requirement is equally important. Every data broker doing business in California must register annually with CalPrivacy, pay a fee, and disclose the categories of personal information they collect. That registry is public, so you can verify whether a specific broker is registered before you submit a DROP request or file a complaint.
Other states are paying close attention. Industry reports document that some states are watching California’s rollout and copying parts of the DROP model rather than building registry-only systems, which suggests the centralized-portal approach is gaining traction as a legislative template.
How do other states compare on broker removal rights?
The honest answer is: it varies a lot. Multiple states have adopted or proposed registry-style and deletion-right measures, but they vary in fees, penalties, and whether they pair registries with deletion obligations. Some states require registration but grant no deletion right. Others grant deletion rights through broad privacy laws but have no broker registry at all. A few are building toward the California model.
A few practical points for consumers whose data sits across multiple states:
- Your rights follow your state of residence. A California resident can use DROP even if the broker is headquartered in Texas.
- Broad privacy laws (Colorado, Virginia, Connecticut) grant deletion rights without requiring broker-specific registration, so you can submit individual requests to brokers under those laws even without a registry.
- No state outside California currently offers a centralized one-request portal. Everywhere else, you submit requests broker by broker.
- Connecticut and New Jersey have expanded their definitions to cover API licensing and data collectors, closing loopholes that older laws left open.
The patchwork is real. The absence of a uniform federal broker-removal mechanism leaves consumers dependent on state laws or voluntary broker opt-outs, which means your protection is only as strong as your state’s law.
What are the real limits on broker removal requests?
Knowing your rights is step one. Knowing where those rights stop is just as important.
Statutory exemptions carve out large categories of data from deletion obligations:
- FCRA data: Consumer reporting agencies (credit bureaus, tenant-screening firms, employment-screening firms) are largely exempt. You cannot use state privacy laws to delete a credit report.
- GLBA data: Financial institutions and their data-sharing practices fall under federal law, not state broker statutes.
- HIPAA data: Health records held by covered entities are outside state broker-removal reach.
- Publicly available information: Most state laws exempt data that is genuinely public record (court filings, property records, voter registration in states where it is public). This is a significant carve-out because people-search sites often source exactly this data.
- Law enforcement and national security: Disclosures to government agencies for these purposes are broadly exempt.
For a closer look at which specific data categories commonly survive removal requests, the Techstacktoday guide on suppressed data categories breaks down what gets removed and what doesn’t.
Practical frictions compound the statutory limits:
- Registry incompleteness. Many brokers fail to register in every state where they arguably should. Academic and practitioner work documents gaps in registries and inconsistent registration by many brokers, so DROP and similar portals do not guarantee complete coverage.
- Verification challenges. Brokers can deny or delay requests if they cannot verify your identity. Automated or bulk requests face the most pushback.
- Offshore brokers. A broker operating outside U.S. jurisdiction is not bound by state law. State attorneys general have limited reach over foreign entities.
- Re-listing. Brokers re-scrape public records and social sources after deletion. The typical re-listing window practitioners report is approximately 3–6 months, so a one-off deletion rarely sticks permanently.
Pro Tip: Set a calendar reminder to re-check your listings every three months. A single deletion request is a start, not a finish. Ongoing monitoring, whether DIY or through a paid service, is the only way to catch re-listed records before they spread.
How to use state rights and tools to remove your data right now
You do not need a lawyer to start. Here is a sequential workflow:
- Identify which laws apply to you. If you are a California resident, you have DROP plus CCPA/CPRA rights. If you live in Colorado, Virginia, Connecticut, or another state with a broad privacy law, you have deletion rights under that law. Check your state’s attorney general website for the current statute.
- Search the relevant registry. For California, search CalPrivacy’s registered broker list. For Vermont and Oregon, check their AG-maintained registries. Note which brokers are registered.
- Use DROP if you are a California resident. Go to consumer.drop.privacy.ca.gov, create an account, verify your identity, and submit. One request covers all registered brokers.
- Submit individual requests for brokers not covered by DROP. For unregistered brokers or residents of non-DROP states, submit directly to each broker. Include:
- Full legal name and any aliases
- Current and recent addresses
- Date of birth
- Email address associated with the listing
- A citation of the applicable statute (e.g., “pursuant to Cal. Civ. Code § 1798.105” for California, or your state’s equivalent)
- A copy of a government-issued ID if the broker requires it
- Track your requests. Keep a log with the broker name, date submitted, method, and expected response deadline. Most statutes require a response within 45 days, with a possible 45-day extension.
- Escalate if ignored. File a complaint with your state attorney general or CalPrivacy. In states with private rights of action, consult an attorney about a civil claim.
For brokers not covered by any state law, such as offshore operators, your options are limited to voluntary opt-out forms. The Techstacktoday guide on removing yourself from the internet covers those manual tactics in detail.
Multi-state exposure tip: If you have lived in multiple states, brokers in each state may hold records. Submit requests under each applicable state’s law, not just your current state of residence. Some brokers honor deletion requests from any U.S. resident regardless of state law, so it is worth asking even when your state lacks a specific statute.
Why centralized portals outperform registry-only laws
Registry-only laws have a structural problem. Privacy researchers describe the “interaction gap”: registries alone fail consumers because they still require users to find and contact each broker individually. A registry tells you who the brokers are. It does not send your deletion request to them. That gap is exactly what DROP closes.
The empirical picture on registries is sobering. Practitioner and researcher findings confirm that broker registries are often incomplete and that deleted records commonly reappear within roughly 3–6 months unless continuously monitored. Even in California, where registration is mandatory and enforced, some brokers fail to register. A DROP request only reaches the brokers who are on the list.
This does not make DROP useless. It makes DROP a floor, not a ceiling. For the brokers it covers, it is far more efficient than submitting individual requests. For the brokers it misses, you still need manual outreach or a paid removal service that sweeps beyond the registry.
Pro Tip: Combine a DROP submission (or equivalent state request) with a monitoring service that checks people-search sites on a rolling basis. The legal request handles registered brokers; the monitoring catches unregistered ones and re-listed records. That combination is more effective than either approach alone.
The AI compliance and data privacy frameworks that larger brokers use to manage deletion workflows are increasingly automated, which means your request may be processed by a system, not a person. That is generally faster, but it also means verification mismatches (a slightly different name or address format) can trigger automatic denials. Submit requests with your information exactly as it appears in the broker’s listing.
How enforcement works and whether you can sue a data broker
Most state broker laws are enforced exclusively by the state attorney general. That means if a broker ignores your deletion request, your primary recourse is filing a complaint with the AG’s office, not suing the broker yourself.
Enforcement mechanisms by type:
- AG enforcement: The AG investigates complaints, issues civil investigative demands, and can sue brokers for violations. California’s CalPrivacy has additional authority to audit registered brokers and impose administrative fines.
- Penalties: California has imposed fines for registration failures; other states have per-day penalties and registration fees. Penalty amounts vary by state and violation type.
- Private right of action: Very few state broker laws grant consumers the right to sue directly. California’s CCPA includes a limited private right of action for data breaches, but not for deletion-request failures. Most deletion-right violations require you to go through the AG.
What to do if a broker ignores your request:
- Document everything. Save confirmation emails, screenshots of your submission, and any broker response (or non-response).
- Note the statutory deadline. If the broker misses it, that is a violation you can report.
- File a complaint with CalPrivacy (California residents) or your state AG (other states). Include your documentation.
- If your state has a private right of action for the specific violation, consult a consumer privacy attorney. Organizations like the Electronic Privacy Information Center (EPIC) and Privacy Rights Clearinghouse publish resources on which states allow private suits and under what conditions.
Pro Tip: Screenshot your deletion request confirmation immediately after submitting it. If a broker denies receiving your request, that screenshot is your evidence. Store it in a folder labeled with the broker name and submission date.
Background-check brokers present a specific complication: many of them claim FCRA exemptions even when their primary product is a people-search report rather than a formal consumer report. The Techstacktoday breakdown of background check data brokers explains how to identify which exemption a broker is actually claiming and whether it holds up.
The gap between what state laws promise and what they deliver
State privacy laws have moved faster in the last three years than in the previous decade combined. That is genuinely good news. But the gap between what these laws promise on paper and what they deliver in practice is still wide enough to matter.
The California DELETE Act is the best law of its kind in the U.S. right now. DROP is a real improvement over the broker-by-broker grind. But DROP only covers registered brokers, registration is still incomplete, and re-listing happens faster than most consumers expect. The law gives you a lever. It does not pull the lever for you on a recurring basis.
The states watching California are mostly building registry-only systems, which is better than nothing but leaves the interaction gap intact. Until more states adopt centralized portals with mandatory registration and real enforcement teeth, the practical burden stays on you.
The honest recommendation: use every legal right available to you, but treat a one-time deletion request as the beginning of an ongoing process. If your data exposure is high (you are a public figure, a domestic violence survivor, a healthcare worker, or anyone whose home address creates a safety risk), the math on a paid monitoring service shifts quickly in its favor. If your exposure is lower, the DIY approach with periodic manual sweeps is workable, just not effortless.
Sources
Use these primary and secondary sources to verify deadlines, check registry entries, and track enforcement actions:
This article provides general informational guidance on U.S. state privacy laws and data broker removal. It is not legal advice. Verify current statutes, deadlines, and your specific rights with your state attorney general’s office or a qualified privacy attorney.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.