Data Broker Opt-Out Guide for US Residents: State Laws and Fees

What to take away

• California's Delete Act creates a single deletion mechanism for registered data brokers, with the California Privacy Protection Agency as enforcer.
• Most states with comprehensive privacy laws give residents opt-out and deletion rights, but deadlines and exemptions differ.
• A valid request must identify you, name the right, and use the broker's posted method; brokers must verify you without collecting excess data.
• Brokers that ignore verified requests face state investigations, enforcement actions and civil penalties, plus registration suspension in California.
• Keep copies of every request and reply; they are evidence if you complain to a state attorney general.

Data broker opt-out rights in the United States come from a patchwork of state statutes, not one federal rule. The Federal Trade Commission can act against deceptive or unfair practices, but it does not run a general opt-out registry. State attorneys general and dedicated agencies enforce the rest. That split matters because a broker may be liable in one state and unregulated in another.

Who has jurisdiction over data broker opt-outs

California leads with the Delete Act, administered by the California Privacy Protection Agency (CPPA). The CPPA maintains a registered broker list and a deletion mechanism that consumers will use to send one request to all registered brokers. The California Attorney General shares enforcement authority. The California Delete Act opt out process replaces separate broker requests.

Other states rely on comprehensive privacy laws. Virginia, Colorado, Connecticut, Texas, Oregon, Montana and others grant opt-out and deletion rights. Enforcement usually sits with the attorney general, sometimes with a consumer protection division. The rules travel with the resident, not the broker's headquarters, though enforcement often requires a state nexus. Jurisdiction fights are common, as seen in romance scam law where location determines the case.

What a compliant deletion request must disclose

A consumer request under California law must include your name, contact information, the right invoked, and enough detail to find your record. The broker may ask for verification, but it cannot demand a fee or an excessive data bundle.

The broker's response must confirm receipt, describe the categories of personal information it holds, list sources and purposes, identify third parties, and state whether it deleted or denied the request. Denials must cite a statutory exemption. The CFPB publishes CFPB consumer resources on limiting data sharing and disputing errors. A parallel disclosure structure appears in a phishing scams policy template.

Party	Required contents	Timing
Consumer	Name, contact, right invoked, record identifiers	Before submission
Broker	Confirmation, categories, sources, purposes, recipients, deletion status	Within statutory window
Regulator	Complaint, proof of request, broker response	After deadline passes

Records brokers and consumers should keep

Businesses covered by the California Consumer Privacy Act must maintain records of consumer requests and how they responded for 24 months. Those records include request dates, responses, and denial bases.

Consumers should keep a parallel file. Use this checklist:

• Copy of the submitted request with date and method
• Screenshot or email confirmation from the broker
• Broker's substantive response or denial
• Complaint number if you file with a state attorney general

If a broker also supplies background checks, retention errors can follow you, as covered in background checks. The FTC privacy guide explains how opt-outs fit with broader data practices.

What happens if a broker ignores a request

A verified deletion request starts a clock. California law requires a response within 45 days, with a possible 45-day extension when reasonably necessary. If the broker fails to respond or denies without a valid exemption, the consumer can complain to the CPPA or the Attorney General.

The concrete consequence is enforcement. The CPPA can investigate, issue orders, and seek civil penalties. Under the Delete Act, a broker that fails to register or comply can be suspended from the deletion mechanism, which cuts off its access to consumer requests.

Where state rules differ on deletion and fees

State laws vary on who may request deletion, how long the broker has, and which exemptions apply. California's Delete Act separates consumer deletion from the fee schedule the CPPA sets for broker access to the mechanism. Consumers do not pay that fee. Consumer requests are free; broker registration fees vary.

State	Core right	Regulator	Notable limit
California	Deletion via Delete Act	CPPA and Attorney General	Brokers must register
Colorado	Opt-out and deletion	Attorney General	Appeals process applies
Connecticut	Opt-out and deletion	Attorney General	Authenticated requests
Texas	Opt-out and deletion	Attorney General	Broker registration required
Oregon	Opt-out and deletion	Attorney General	No consumer fee

People search sites often count as brokers. State rules also differ on private rights of action, cure periods and whether a broker must delete data it received from another source. The data broker removal service cost is not set by state law, and consumers can submit requests themselves. For a wider view of how state rules shift, see marketplace scams rules.

Common questions

Do I have to pay to remove my data from a data broker? No. State privacy laws make consumer deletion and opt-out requests free.

What information can a broker demand to verify my request? Enough to confirm you are the person whose record is at issue.

Which regulator do I contact if a broker ignores me? Start with the state attorney general where you live. California residents can also file with the CPPA. The FTC takes complaints about deceptive practices.

Does the California Delete Act cover every data broker? It covers brokers that meet the registration threshold and operate in California.