How to Opt Out of Data Brokers and People-Search Sites

Your name, home address, phone number, and even your relatives' names are almost certainly for sale online right now, and you never agreed to it. Data brokers buy, scrape, and resell that information to anyone with a credit card, and it is the raw material behind spam calls, doxxing, and impersonation scams — and unlike a data breach, nothing needs to be hacked for it to happen. The good news: you can push back. The Federal Trade Commission publishes a free opt-out playbook, and as of 2026 California residents can wipe their information from hundreds of registered brokers with a single request through the state's new Delete Request and Opt-Out Platform (DROP). Here is how data brokers get your information, why it is worth the hour it takes to opt out, and the concrete steps to do it.

What is a data broker?

A data broker is a company that collects personal information from a wide range of sources and then sells or licenses it to other businesses, marketers, or the public — without you ever doing business with the broker directly. That is the FTC's own working definition, and it covers two overlapping categories that matter to most consumers.

The first is the "people-search" site: services like Spokeo, Whitepages, and BeenVerified that let anyone type in a name and pull up a report containing an address history, phone numbers, relatives, and sometimes property or court records. The second is the marketing and identity-resolution broker, such as Acxiom, which aggregates shopping, demographic, and behavioral data and sells profiles to advertisers rather than to individual searchers. Some companies, including background-check services, blend both models. All of them are legally required to register in states that maintain a data broker registry, including California's.

How data brokers get your information

According to the FTC, people-search sites in particular build their reports from a mix of sources: they buy data from other data brokers, pull publicly viewable information from social media profiles, and compile government public records — property records, driving records, voter registration files, and criminal records among them. Marketing-focused brokers add another layer, licensing purchase histories and app or web activity from retailers, data co-ops, and ad-tech partners.

Because so much of this comes from records that are technically public, no single law stops it. A broker does not need your permission to combine your voter registration, an old apartment lease, and a public LinkedIn profile into one file — it only needs the will to do it and a way to sell the result.

Why it matters: scams, doxxing, and spam calls

A people-search report is a ready-made toolkit for a scammer. A phone number and a relative's name is enough to fake a "grandparent scam" call; an address history is enough to make a phishing text about a missed delivery feel personal; a full profile is enough to answer the security questions on an account-recovery form. The FTC's guidance specifically flags survivors of domestic violence or stalking as a group who "may not want anyone to find out where they live, or the name and address of their family members" — but the same exposure creates risk for anyone whose information ends up in the wrong hands, from spam callers to people running impersonation or doxxing campaigns.

None of that requires a data breach. It only requires that the information was compiled and sold in the first place, which is the normal, everyday business of a data broker.

Start with the FTC's official guidance

The FTC's consumer guidance on people-search sites lays out the baseline process for opting out yourself, for free: search for your own name on a given people-search site, find that site's opt-out or "do not sell my info" link, and follow its removal steps. Because there is no single registry of every broker, the FTC's guidance is explicit that you will need to repeat the process across multiple sites, and check back periodically, since your information can reappear if the underlying public records change or a broker refreshes its database.

The FTC is also blunt about the limits of this process: opting out of a people-search site does not delete your information from the public record it came from, so "someone could find public records about you on a government website" even after a successful opt-out. Opting out removes a broker's compiled report about you — it does not make the underlying facts disappear.

California's one-stop mechanism: the Delete Act and DROP

California has gone further than opt-out-by-opt-out. Under the Delete Act (Senate Bill 362), every data broker that meets the state's registration threshold must register annually with the California Privacy Protection Agency (CPPA) and, since the law's accessible deletion mechanism took effect, must act on deletion requests submitted through it. That mechanism is the Delete Request and Opt-Out Platform, or DROP, which the CPPA describes as letting "a consumer, through a single verifiable request, direct every data broker that maintains any personal information related to that consumer... to delete such information."

DROP went live on January 1, 2026, and is free to use at the consumer portal, privacy.ca.gov/drop. Registered brokers must begin processing requests submitted through it by August 1, 2026, and after that must check the platform and act on new requests at least once every 45 days. To use it, a California resident verifies their identity through the state's identity-verification system (or a Login.gov account), builds a profile with the minimum information needed to match broker records, and submits one request that fans out to every broker registered with the CPPA rather than to each one individually.

DROP does not cover every business that touches your data — only companies that meet the Delete Act's definition of a "data broker" and have registered with the CPPA, which by mid-2026 numbered in the hundreds. It also will not remove information from a source that is not itself a registered broker, such as a government records site.

Federal recommendations and other states

The FTC has pushed Congress for years to require a centralized, industry-wide opt-out portal and to make data brokers disclose what they collect and how — recommendations it first laid out in a 2014 report on the industry. No federal law has created a DROP-style mechanism nationwide, which is why California's system is currently the exception rather than the rule. A handful of other states now run their own data broker registries, so if you live outside California it is worth checking whether your state attorney general's consumer-protection site lists a registry or complaint process for brokers operating there; California's own registry, maintained by the state Department of Justice, is a useful model of what that information looks like in public, and it is also where each broker's legally required opt-out contact is filed.

How to opt out of major people-search and data broker sites

Outside of California — or in addition to a DROP request, since DROP only reaches brokers registered with the CPPA — you can go directly to a broker's own opt-out page. Each site's process is slightly different, but they generally ask you to locate your own listing, then verify the removal request by email, phone, or a short identity check.

If you cannot find a broker's opt-out page from its own site, California's data broker registry lists the opt-out contact every registered broker is legally required to file, including a URL, email, or phone number, and is worth checking as a source of truth.

Do-it-yourself opt-outs vs. paid removal services

Every opt-out described above is free and can be done yourself. The trade-off is time: there are dozens of active people-search and marketing data brokers, and some resurface a listing after a few months, which means opting out is closer to a recurring chore than a one-time task. That is the gap paid personal-data-removal services are built to fill — they submit and re-submit opt-out requests across a list of brokers on your behalf for a recurring fee.

A paid service does not have any legal access or removal power that you do not also have yourself; it is submitting the same public opt-out forms, just at scale and on a schedule. Whether that is worth paying for depends on how much of the repetitive follow-up you want to do by hand. Either way, start with the free options — the FTC's guidance and, if you live in California, DROP — before paying anyone to do the same steps for you.

A step-by-step opt-out checklist

A practical order to work through, based on the FTC's guidance and DROP's own process:

1. California residents: start with DROP. Verify your identity, submit one request, and it fans out to every broker registered with the CPPA.
2. Everyone else: search your own name on the major people-search sites (Spokeo, Whitepages, BeenVerified, and similar), and use each site's own opt-out link.
3. Confirm each removal. Most opt-outs require you to click a confirmation link sent by email — without that step, the request typically does not go through.
4. Check the marketing-data brokers too. Sites like Acxiom's opt-out page cover advertising profiles, which people-search opt-outs do not touch.
5. Set a reminder to re-check in a few months. Listings can reappear when a broker refreshes its data or a public record changes.
6. Report harassment or stalking risk tied to exposed information to local law enforcement or, for identity-theft-specific harm, through the FTC's own reporting tools at consumer.ftc.gov.

What opting out won't fix

Opting out changes what a broker sells about you going forward; it does not rewrite history. The FTC is explicit that removing a people-search listing does not touch the underlying public record, so the same information can still be found directly on a government website, and it can still show up in a report about a relative, neighbor, or associate that happens to mention you. Opting out also only reaches brokers you know about and have identified — new brokers can start compiling a profile on you at any time, which is exactly the recurring-chore problem the DIY-vs-paid tradeoff above is about.

What to do next

If you live in California, the highest-leverage move is a single free request through DROP — it is the closest thing to a one-stop opt-out that exists today. If you live anywhere else, work through the FTC's guidance one people-search site at a time, starting with the ones most likely to show up when someone searches your name, and add the marketing brokers like Acxiom once the people-search sites are handled. While you are tightening up your privacy hygiene, it is also worth locking down the accounts a scammer could target with the personal details a broker exposes — see our guides on setting up passkeys and two-factor authentication, and if you want to know whether your accounts have already turned up in a breach, our explainer on Have I Been Pwned covers how to check.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage