Data Removal & Opt-Out Process

A company that files opt-out and deletion requests with brokers on your behalf and re-checks the sites afterwards. Delist My Data is one.

The category has no statutory definition and no licence behind it. Removal services do not appear on California's data broker registry either, since they publish nothing themselves, so the registry is no help in telling a good one from a bad one. What separates them in practice is how many sites they cover and what they do after the first pass, because re-listing decides whether any of it lasts.

The opt-out link a business has to publish, worded exactly that way. Civil Code § 1798.135 requires a clear and conspicuous homepage link under that title from anyone who sells or shares personal information.

The wording is prescribed because companies used to bury the choice or rename it into something nobody would recognise. "Share" joined the title under the CPRA so that advertising transfers, where no money changes hands, could not sidestep it. On a broker site this link is often the quickest way in, though following it usually leads to a verification step rather than a result.

A browser signal telling every site you visit not to sell or share your data. The W3C specification defines it as an HTTP header and a matching property websites can read.

Regulators treat it as a request rather than a preference. GPC was the first mechanism Colorado recognised on its universal opt-out list, and California's 2022 Sephora settlement turned on a failure to honour the signal at all. It saves repeating the same opt-out on site after site, but most people search sites ignore it, so it adds to filing removals rather than replacing them.

A step-by-step walkthrough for getting your listing off one particular broker site.

Ours are at opt-out guides, one per broker, with screenshots of the real forms. The authority behind any such guide is the broker's own live opt-out page, which is why they date so quickly. California's broker registry is where to check who is even required to offer one.

The submission itself: the form, email or letter asking a business to stop selling your data or to take your listing down.

California requires the route to exist, since Civil Code § 1798.135 obliges anyone selling or sharing personal information to carry the opt-out link. Californians also have a collective route now: one request through the state's DROP portal reaches over 600 registered brokers, which must check it every 45 days from August 2026. Everyone else still files site by site, and an opt-out is not the same ask as a deletion.

When a profile you already removed reappears on a broker site, because the broker scraped its sources again or bought the same records back from another one.

This is why removal behaves like a subscription rather than an errand. California's Delete Act aims straight at it: under Civil Code § 1798.99.86(d), a registered broker that has deleted your data must go on deleting it at least once every 45 days from August 2026, and must not sell new records about you. Nothing compels that elsewhere, so a listing cleared today can return with the next aggregator refresh.

The acknowledgement a broker sends once it has processed a removal: an email, an on-screen message, or a status page.

Plenty of brokers send nothing at all. California owes you an answer within 45 days under Civil Code § 1798.130, but an answer is not proof the listing went anywhere. A profile that no longer appears in a search looks identical to one never indexed under that spelling of your name. Search the free preview page again a week later and keep a dated screenshot of the request and the empty result. A verification email is not a confirmation.

A record a broker keeps of people who have opted out, so their details are held back from future publication instead of being deleted once and forgotten.

This is trade practice rather than law, and it decides whether a removal holds or quietly undoes itself at the next import. Some operators run it as a product: PeopleConnect keeps a suppression centre covering several of its sites from one form, though not all of them. Worth asking whether a suppression file exists before counting a deletion as finished, because re-listing is what happens when it does not.

The identity check a business runs before acting on a request, meant to stop somebody else deleting your data or collecting a copy of it.

It does not buy the business time. Civil Code § 1798.130 gives 45 days to respond and says explicitly that verifying a request does not extend that duty. Broker opt-outs stall here more than anywhere else, usually when the site asks for a scan of the ID you were trying to get off the internet. Send only what identifies the listing, and keep whatever removal confirmation comes back.