Protégete

A data broker is a company that builds a profile of you without ever having met you. It combines public records - property, voter rolls, court filings, licences - with data bought from apps, loyalty programmes and other brokers, then sells the result to advertisers, background-check services, insurers and anyone else who pays.

You did not sign up, and in most cases you were never told. That is what makes opting out feel unfair: the work of removing your data falls on you, while the work of collecting it fell on nobody.

The first thing to be clear about is what opting out actually achieves. It removes your profile from the broker's public-facing product, usually within a few weeks. It does not delete you from the internet, it does not touch the copies already sold, and it does not stop the same broker from rebuilding a profile later from fresh public records. Anyone who promises otherwise is selling something.

Your legal footing depends on where you live, and it is uneven. In the EU and UK, the GDPR gives you a right to erasure that applies to any company processing your data, brokers included, and they must respond within a month. In California, the CCPA and CPRA give a right to deletion and to opt out of sale; the state has also built a single register where you can, in principle, reach many brokers at once. Several other US states have passed comparable laws. Outside those regimes, you are relying on the broker's own policy, which exists mostly because it is cheaper than litigation.

The practical process is the same everywhere and it is repetitive. Find the broker's opt-out or privacy request page - it is rarely in the footer where you would expect. Search for yourself and identify the records that are actually you, which is harder than it sounds when your name is common. Submit the request, usually with an email address and sometimes a phone number. Confirm by clicking the link they send. Then wait, and check again in a month.

The uncomfortable part is the identity verification. Some brokers ask for a photo of an ID document to process a deletion request, which means handing more data to a company you are trying to leave. Where the law allows it, refuse and insist - under GDPR, verification must be proportionate, and a scan of a passport rarely is. Where you have no leverage, weigh whether that particular broker's profile is worth the trade. It sometimes is not.

Paid removal services exist and they do save real time. What they sell is labour, not a capability you lack: they submit the same requests, track the responses and resubmit when profiles reappear. Judge them on whether they publish their broker list and their reappearance rate. Be wary of any that describe the result as permanent, because reappearance is a structural feature of the industry, not a failure of the service.

Which brings us to the part almost nobody mentions in advance. Profiles come back. Brokers refresh from public records on a cycle, and a deletion made in March can be undone by a routine ingest in September - legally, since the source is public. Opting out is therefore not a task you complete but a maintenance job you repeat, once or twice a year, on the brokers that matter most to you.

Where does that leave a reasonable person? Prioritise. Start with the people-search sites that surface first when someone searches your name, because those are the ones that affect you in practice. Handle the largest aggregators next, since they feed the smaller ones. Ignore the long tail unless you have a specific reason - a stalker, a security clearance, a public role - in which case the exhaustive approach is justified and a paid service probably is too.

And reduce the inflow while you are at it. Every opt-out you win is undone by the next app that sells your location or the next loyalty card that sells your purchases. The removals are the cure; declining to hand over data in the first place is the only prevention that scales.