Data brokers collect personal information they never obtained from you directly, combine it into a profile and sell access to it, drawing on public records, retailers, apps and online tracking. You can demand erasure under GDPR in the EU and UK, opt out of sale under California's CCPA and, since 2026, file one deletion request covering registered California brokers; elsewhere you rely on voluntary opt-outs.
What a data broker is
The defining feature of a data broker is that you have no relationship with it. A retailer that keeps your purchase history is a business you dealt with; the company that buys that history, links it to your voter registration and your browsing profile and sells the result is a broker. The US Federal Trade Commission's 2014 study described brokers holding data on nearly every American consumer, drawn from hundreds of sources, and sorted into inferred segments. The industry has consolidated and automated since, and several US states now require brokers to register, which for the first time gives a public list of who they are.
Brokers come in three rough kinds, and the removal process differs for each:
- People-search sites publish a profile page per person, built mostly from public records: name, age, relatives, current and past addresses, phone numbers, sometimes property and court records. They are the visible face of the industry and the easiest to opt out of, because you can find your own page.
- Marketing and risk brokers sell segments and scores in bulk to advertisers, insurers, lenders and employers' screening providers. They rarely expose a profile, and their data is inferred as much as recorded: likely income bracket, health interests, propensity to move.
- Location and ad-tech brokers resell the location pings and identifiers harvested from apps and from the real-time bidding stream described in the tracking guide.
Where the data comes from
| Source | Examples | Can you cut it off? |
|---|---|---|
| Public records | Voter rolls, property deeds, court filings, business registrations, licences | Rarely; some states allow confidential voter registration |
| Commercial partners | Loyalty schemes, warranty cards, subscriptions, credit header data | Partly: decline optional fields, use a separate email |
| App SDKs | Location, advertising identifier, contacts, from apps bundling third-party code | Yes: deny location, reset or deny the advertising ID |
| Web tracking | Browsing profile keyed to cookies or fingerprint, matched to a hashed email | Largely: tracker blocker, cookie deletion, GPC signal |
| Breaches | Leaked databases resold or scraped | No, only mitigated; see the breach guide |
| Other brokers | Brokers buy from each other, which is why profiles regenerate | Only by removing at the source brokers |
The last row is the one that makes removal frustrating. Deleting your profile at one broker does not stop it buying the same data back from another next quarter. Sustainable removal therefore has two halves: cutting off the inflow you control, and repeating the opt-outs on a schedule.
Your rights by region
European Union and United Kingdom
The GDPR applies to brokers processing data of people in the EU, and the UK GDPR mirrors it. The relevant rights are access (Article 15: a copy of everything held about you and its sources), erasure (Article 17), and objection to processing for direct marketing (Article 21, which cannot be refused). A broker must respond within one month, extendable once. Brokers that never had a lawful basis for the data, which regulators have found repeatedly in this sector, are obliged to delete it on request. If a broker ignores you, the complaint goes to your national supervisory authority, and in the UK to the ICO.
California
The CCPA as amended by the CPRA gives California residents the right to know, delete and correct, and the right to opt out of sale or sharing. Businesses must honour an opt-out preference signal such as Global Privacy Control, which the GPC guide explains. The Delete Act (SB 362, 2023) goes further for brokers specifically: they must register with the California Privacy Protection Agency, and the agency operates a single Delete Request and Opt-out Platform (DROP) through which a resident submits one request that every registered broker must then process, with brokers required to check the platform on a recurring basis. Consumers could begin submitting requests at the start of 2026, with brokers' processing obligations following later in the year. This is the most significant change in the sector in a decade, because it replaces hundreds of individual opt-outs with one.
Other US states
Vermont, Texas and Oregon also maintain broker registries, and the comprehensive privacy laws in Colorado, Connecticut, Virginia and a growing list of states give residents deletion and opt-out rights against businesses including brokers. Residents of states without such a law have only the brokers' voluntary opt-out processes, which most large brokers offer to everyone regardless of location.
A realistic removal process
- Cut the inflow first. Install a tracker blocker, delete cookies automatically, turn on the GPC signal, deny location to apps that do not need it, and reset or disable the advertising identifier on your phone. Our browser extension covers the first two; the browser check confirms whether your browser is sending Global Privacy Control.
- Search yourself. Search your name with your city, your phone number and your email address, and list every people-search site that returns a profile. Note the URL of each profile; opt-out forms usually require it.
- Use the statutory route where you have one. If you are in California, file through the CPPA's platform. If you are in the EU or UK, send erasure requests; the template below is sufficient.
- Work through the voluntary opt-outs for people-search sites, largest first. Expect identity verification, sometimes a mailed code, and occasionally a demand for a photo of an ID, which you should refuse or redact to the fields they need.
- Target the upstream brokers. The large marketing brokers publish opt-out pages that remove you from their marketing products; because people-search sites buy from them, this reduces regeneration.
- Record and repeat. Keep a list of each broker, the date and the confirmation. Re-run the search every three to six months; profiles reappear, and a second removal is faster than the first.
A GDPR erasure request needs no special form. Sent to the broker's data protection contact, this is enough:
Subject: Erasure request under Article 17 GDPR
I am a data subject resident in [country]. Under Article 15 GDPR, please
confirm whether you process personal data relating to me and, if so, provide
a copy together with the sources from which you obtained it (Article 14).
Under Article 17 GDPR I require you to erase all personal data relating to
me. Under Article 21(2) I object to any processing for direct marketing,
including profiling. Please confirm erasure within one month and confirm
that any recipients to whom you disclosed the data have been informed
(Article 19).
Identifying details: [full name], [postal address], [email addresses].Provide the minimum needed to identify the record; a broker asking for a passport scan to delete a marketing profile is asking for more than it needs, and you may say so.
Cutting the inflow in practice
Because profiles regenerate from fresh data, the steps that stop new data arriving are worth more over a year than any single opt-out. They are also the ones most people skip.
- Advertising identifiers. On iOS, Settings, Privacy & Security, Tracking, turn off "Allow Apps to Request to Track"; on Android, Settings, Google, Ads, delete the advertising ID. Without a stable identifier, app-derived location and behaviour data is far harder to attach to you.
- Location permission. Grant it only while using the app and only to apps that need it for their function. Weather, shopping and games do not.
- Forms. Leave optional fields blank. A date of birth and a phone number on a loyalty form are the two fields that let a broker match the record to the rest of your profile.
- A separate email address for shopping and sign-ups keeps your primary address out of the commercial datasets that brokers match on.
- Public records. Where your jurisdiction allows confidential voter registration, or lets you use a mailing address on business and property filings, take it; these are the sources that cannot otherwise be revoked.
Removal services
Subscription services such as DeleteMe, Optery, Incogni and Kanary automate the people-search opt-outs and repeat them on a schedule. They are worth paying for if you would otherwise not do the repeats, which is most people. Two cautions. They cover the brokers on their list, which is the people-search tier and some marketing brokers, not the whole industry; and they require your personal details to do the work, so pick a service on its own privacy terms and its published broker coverage, not on advertising. A service that promises complete removal from "the internet" is overstating what any process can do.
Why it matters beyond ads
Broker profiles are the pretext material for social engineering: a caller who knows your address, relatives and previous employer sounds legitimate, and a SIM-swap attacker uses the same details to pass a carrier's identity check. They are also what makes a leak from a breach more dangerous, since partial breached data is completed from the profile. And a people-search page is the standard starting point for harassment and stalking, which is why survivors' advocates treat opt-outs as a safety measure rather than a privacy preference. Reducing what brokers hold reduces all three risks at once. Your IP address and location history feed the same profiles, and the privacy hub connects the rest of the picture.
