How to Use CCPA to Remove Your Personal Data From Data Brokers

The California Consumer Privacy Act gives you the legal right to demand data brokers permanently delete your personal information: your name, address, phone number, relatives' names, and more. And critically, you do not need to live in California to use it. Here is the practical guide to doing it.

Who Can Use the CCPA?

Technically, the CCPA only grants rights to California residents. But in practice, most major data brokers apply their CCPA compliance procedures to all US residents, regardless of which state they live in. There are two straightforward reasons for this:

• State residency is hard to verify. When someone submits an opt-out or deletion request, a data broker typically has no reliable way to confirm which state that person currently lives in. Denying the request and guessing wrong creates legal exposure. Processing it is simpler and safer.
• Other states have passed similar laws. As of 2026, more than 13 states have comprehensive consumer privacy legislation. Rather than maintain 13+ separate compliance workflows, most brokers apply a single national policy based on the strongest existing standard — which is generally the CCPA.

In practice: if you submit a CCPA-style deletion request to a major data broker today, it will almost certainly be processed regardless of where you live. The law's practical reach extends well beyond California's borders.

Step 1: Find the Broker's Opt-Out Page

Every CCPA-covered business is required to include a link labeled "Do Not Sell or Share My Personal Information" on their homepage. This is a legal requirement. Here is how to find it quickly:

• Scroll to the footer of the site's homepage. This is the most common location.
• Check the site's Privacy Policy page, which should include a link or instructions.
• Search Google for: [company name] do not sell my information or [company name] opt out.
• Search Google for: [company name] CCPA deletion request.

If a covered business does not have this link, that is itself a CCPA violation you can report to the California Privacy Protection Agency at cppa.ca.gov.

Step 2: Locate Your Profile

Before submitting your deletion request, it helps to find your specific record on the site so you can reference it in the request form. This makes it easier for the broker to locate and delete the correct entry, especially if you have a common name.

Use the site's search function and enter your full name plus city and state. If you find your listing, copy the URL. Some brokers' deletion forms include a field where you can paste the direct link to your profile, which speeds up processing.

Step 3: Submit the Deletion Request

Most data brokers have a webform for submitting deletion requests. You will typically be asked to provide:

• Your full legal name
• Your email address (used to send a verification link)
• Your state of residence
• The URL of your listing on their site (if you found it in Step 2)
• Sometimes: a phone number or physical address associated with the record

Do not provide more information than the form requires. You are not obligated to upload a government ID or provide your SSN to submit a deletion request. This is an increasingly rare practice and raises its own privacy concerns.

Step 4: Verify Your Request

This is the step most people miss. After submitting the form, check the email address you provided for a verification email. Almost every data broker sends one before processing the request.

The verification email will typically contain a link you must click to confirm that you own the email address and that you are the one who submitted the request. Without clicking this link, the broker will not process the deletion. Your request simply sits in a queue indefinitely.

Step 5: Wait and Follow Up

Under the CCPA, businesses must respond to a deletion request within 45 calendar days. They may extend this by an additional 45 days if they notify you and explain the reason. That means the maximum legal response window is 90 days.

If you do not receive a response within 45 days, or receive a denial without a legally valid reason, you have several options:

• Escalate within the company. Email the business's legal or compliance team directly, referencing your original request and the submission date.
• File a complaint with the CPPA. The California Privacy Protection Agency accepts consumer complaints at cppa.ca.gov. You do not need to be a California resident to file.
• Report to your state attorney general. If your state has a privacy law, your AG may have jurisdiction as well.

The Problem With Doing This Manually

The process above works. But here is the problem: there are 500+ registered data brokers in the United States. Each one requires a separate request. Each one has a different form, different fields, and a different verification process. And many re-add your data within months, meaning the cycle starts over. For site-specific instructions, see guides for Spokeo, Whitepages, and BeenVerified.

The 10-minute-per-broker estimate is conservative. It accounts for: finding the opt-out page, locating your profile, filling out the form, checking email, clicking the verification link, and confirming the request was received. Some brokers are faster; many take longer.

There is also a compounding problem: data brokers regularly re-add your information after deletion. They purchase data from other sources, credit bureaus, public records aggregators, marketing databases, and your record reappears within months. A one-time manual opt-out is not a permanent solution.

The Automated Alternative

The CCPA explicitly allows you to designate an authorized agent to submit privacy requests on your behalf. An authorized agent can exercise all of your CCPA rights, including the right to deletion, provided you have authorized them to do so in writing.

This is how GhostVault works. When you sign up, you authorize GhostVault to act as your authorized agent under CCPA. GhostVault then submits deletion requests to 500+ registered data brokers simultaneously, using the exact same legal mechanism as the manual process above, but automated and continuous.

When brokers re-add your data (and they will), GhostVault detects it and resubmits. For $3.99/month, you replace 80+ hours of manual work with a service that runs continuously in the background. Same legal right, exercised automatically.