Data Broker Laws: Registration, Deletion Requests, and Opt-Out Rights

People asking how to get their information away from data brokers are usually asking about three different rights at once. Deletion tells a company to erase what it holds. Opting out tells it to stop selling or sharing the data going forward, while it keeps the file. An FCRA dispute corrects an inaccurate entry in a consumer report used for credit, insurance, or employment decisions. Different laws create each one, different bodies administer them, and a request aimed at the wrong lane simply does not do the thing you wanted.

The three lanes, and why mixing them wastes a request

Sorting the request first saves the most time. Sending a deletion demand to a credit bureau about an account you believe is wrong will not fix the account, and opting out of sale will not remove a profile that is already published.

Registration matters more than it sounds. You cannot send a request to a company you have never heard of, and brokers by definition have no direct relationship with the people in their files. A state registry converts an invisible industry into a list you can work through.

What federal law covers, and what it leaves to the states

There is no general federal statute requiring data brokers to register or to honour deletion requests. Federal law reaches slices of the industry instead.

The Fair Credit Reporting Act governs consumer reporting agencies and the specific uses their reports are put to — credit, insurance, employment, tenant screening. A broker that sells marketing lists is usually outside it. The Federal Trade Commission's authority over unfair or deceptive practices reaches how any company describes and handles data, and the agency publishes business guidance that sets out what it expects. Neither of those is a registration regime.

Registration and deletion duties come from state statutes. California and Vermont were the early states to require data brokers to register with a state agency, and other states have since adopted their own versions. The requirements are not uniform, so which rights you have depends on where you live rather than on any national floor.

Note: Beacon does not print registration fees or penalty amounts. They are set by statute and regulation and they change. The administering state agency's page is the only reliable place to read the current figure.

California, for example

California requires data brokers to register with the state and layers a centralised deletion mechanism on top of the individual rights in its consumer privacy law. That framework, administered by the California Privacy Protection Agency, is designed to let a resident make one request that reaches registered brokers rather than contacting each one separately.

It is phasing in as of mid-2026, with obligations arriving on a staged schedule rather than all at once. Because the dates and the mechanics have moved, the right reference is the state's own material — the California Attorney General's CCPA page explains the underlying consumer rights and points to the current process. Treat California as a labelled example, not as the national rule.

Making a request, end to end

1. Decide which lane you are in. Delete, opt out, or dispute an inaccuracy in a consumer report. Write the answer down before drafting anything.
2. Find out which state law you can rely on. Rights follow your state of residence. If your state has no broker statute, you may still have leverage through a company's own published policy.
3. Build the list of brokers. Start with the state registry if one exists, then add the people-search sites that surface when you search your own name and old addresses.
4. Locate each company's request channel. Most publish a web form, a dedicated address, or a toll-free line. Use the published channel; requests sent elsewhere are routinely treated as not received.
5. State the request precisely. Name the right you are exercising, the state law you are relying on, and the identifiers needed to find your record — full name, current and prior addresses, and any profile URL.
6. Expect an identity check. Brokers generally must verify that the requester is the person in the file. Provide only what the published process asks for, and no more.
7. Record everything. Save the date sent, the confirmation, the reference number, and a screenshot of the listing before it disappears.
8. Check back and re-file. Search again after a few weeks. Records rebuilt from new public-record feeds are common, and a second request is usually necessary.

Practical step: Work from a plain spreadsheet with one row per broker — company, date sent, channel used, reference number, result, recheck date. Removal projects fail from lost tracking far more often than from refusals.

The limits nobody advertises

Deletion is per-broker unless a state runs a central mechanism. Erasing one company's copy has no effect on the next company's, and the industry's suppliers overlap heavily.

Public records are the second limit. Court filings, property records, voter files, and licensing databases are lawful sources, so information deleted today can reappear tomorrow from the same feed. That is not a violation; it is how the supply chain works. People with safety concerns generally need the underlying record shielded, which is the point of address confidentiality programs and keeping an address out of court records.

Statutory exceptions are the third. Businesses may keep data needed to complete a transaction, comply with a legal obligation, prevent fraud, or maintain security. A denial that cites an exception is not automatically wrong, though it should say which one applies.

Where does the data come from in the first place? Frequently from automated collection, which carries its own legal problems for the collector, set out in our analysis of access, contract, and copyright limits on scraping. Whether a company's own terms permitted the onward sale is a related question covered in our piece on when an online agreement binds.

When a broker ignores you

Non-response is common, and there is no self-executing remedy. Escalation runs through regulators rather than through the company.

Complaints about a company's data practices can go to your state attorney general, to the state privacy agency if your state has one, and to the FTC, which collects reports at its consumer advice site. Regulators generally do not resolve individual disputes, but patterns in complaint data are what drive enforcement. Where the underlying problem is unwanted marketing rather than the file itself, the FTC's advertising and marketing guidance sets out the rules businesses are supposed to follow, and email specifically has its own federal regime described in our explainer on the CAN-SPAM rules senders overlook.

Common questions

How do I find out which brokers hold information about me?

Two routes. If your state maintains a data broker registry, that list is the authoritative starting point, since registered brokers must identify themselves and give a contact channel. Then search your own name together with current and former addresses, and note every people-search site that returns a profile. Between the registry and your own search results you will capture most of the companies that actually publish or resell your details.

Will deletion stop my name reappearing on people-search sites?

Often not permanently. Brokers rebuild profiles from public records, licensing files, and purchased feeds, so a deleted record can be reconstructed from the same sources weeks later. Deletion removes the current copy; it does not block future collection from lawful sources. Plan on rechecking every few months, and keep your original confirmation numbers so repeat requests can reference the earlier one.

Can a family member send a deletion request on my behalf?

Sometimes. Several state privacy laws let an authorized agent submit requests for a consumer, and some allow parents or guardians to act for a minor. The broker can still require proof of the authorization and verify the underlying person's identity, which often means signed permission plus the usual identifiers. Check the specific state statute and the broker's published process before assuming an agent request will be accepted.

Why does a broker want my ID before deleting anything?

Because deleting or disclosing the wrong person's file is itself a privacy failure, and state laws generally require verification proportionate to the sensitivity of the request. That said, verification should not become a data grab. Supply only what the published process asks for, ask whether a redacted document is acceptable, and if a broker demands materially more information than needed to match you to an existing record, treat that as a reason to complain rather than comply.

A workable order of operations

Removal work goes faster when it runs in a fixed sequence rather than in reaction to whatever site turned up last.

Start by naming the lane — deletion, opt-out, or consumer-report dispute — because everything downstream depends on it. Confirm what your state actually gives you, then pull the state registry if one exists and build the broker list before sending anything. Send requests through published channels only, keep evidence of each one, and expect verification.

Then set a recheck date. Re-file where a profile returns, and escalate the persistent refusals to your state attorney general or state privacy agency with your reference numbers attached. Handle credit-report inaccuracies as a separate FCRA dispute rather than folding them into the same letter, and keep the two paper trails apart so neither one gets lost in the other.