Lesson 9.3

Data Broker Opt-Outs

Learning Objectives

After this, students can explain what data brokers are and where their data comes from.
After this, students can complete a manual opt-out and avoid the common pitfalls.
After this, students can evaluate paid removal services using independent research.
After this, students can describe the privacy laws that give people deletion rights, including California’s Delete Act and DROP.
After this, students can set realistic expectations: opt-outs reduce exposure but don’t make it permanent.

What Data Brokers Are

A data broker is a company that collects personal information about people it has no direct relationship with and sells or shares it. You never signed up with them, but they have a file on you.

There are a few broad types:

Type	What they do	Who sees the data
People-search sites	Show profiles of individuals: addresses, phone numbers, relatives, age	Anyone with a browser (often a free preview plus a paid report)
Marketing data brokers	Build consumer profiles for advertising (interests, purchases, demographics)	Advertisers and other businesses
Risk and identity brokers	Provide data for fraud prevention, identity verification, and background checks	Businesses, often under regulations like the FCRA

For OSINT, people-search sites matter most because they put an aggregated profile of almost anyone one search away.

Where the Data Comes From

Brokers combine many sources into a single profile:
- Public records: property records, court records, business filings, and (in states that allow it) voter registration data
- Commercial sources: loyalty programs, warranty registrations, magazine and service subscriptions, online purchases
- Other brokers: data is bought, sold, and resold, so one listing often feeds many sites
- Online activity: public social media profiles and other web sources
- Things you or others submitted: contact info shared with apps and services whose terms allow sharing

The key point for students: each source may be harmless on its own, but the broker does the aggregation for the attacker. This is the mosaic effect, packaged as a product.

Why This Matters for OSINT and Security

Attackers and investigators use people-search sites because they’re fast and cheap:
- Home addresses for physical threats, stalking, or mailing a convincing pretext letter
- Relatives and associates for social engineering (“Hi, I’m your cousin’s friend…”) and answering security questions
- Phone numbers for smishing (SMS phishing), vishing (voice phishing), and SIM-swap attempts
- Age and address history for identity verification bypass

Case study: Judge Esther Salas

In July 2020, a gunman went to the New Jersey home of federal judge Esther Salas. Her 20-year-old son, Daniel Anderl, was killed when he answered the door, and her husband was seriously wounded. The attacker had previously appeared before her in court, and the attack raised national concern about how easily judges’ personal information, including home addresses, could be found online.

The response included:
- New Jersey’s “Daniel’s Law”, which lets judges, prosecutors, law enforcement officers, and their families request that their home addresses and phone numbers not be published (verify the enactment and amendment dates before class).
- The federal Daniel Anderl Judicial Security and Privacy Act, signed in December 2022, which protects federal judges’ personal information.

This is a sobering but effective way to show students that data broker exposure isn’t abstract.

The Manual Opt-Out Process

Most people-search sites offer an opt-out process, though they don’t make it easy. The general pattern:

Search for yourself on the site (name + city/state).
Find every listing that’s you. There may be several (different addresses, name variations, age ranges).
Copy the URL of each listing.
Find the opt-out page. It’s usually linked in the site footer as “Do Not Sell,” “Opt Out,” “Privacy,” or “Remove My Info.”
Submit the request with the listing URL and the minimum information required.
Confirm via email (most sites send a verification link).
Record it in your tracking sheet: site, listing URL, date submitted, confirmation received, date to re-check.
Re-check in 1–2 weeks to confirm removal, then again every few months.

Use a guide

The Big Ass Data Broker Opt-Out List (BADBOOL) on GitHub is a well-known, actively maintained guide to opting out of dozens of people-search and data broker sites. It marks which sites to prioritize first and flags which ones require a phone call, ID, or payment. Since brokers frequently change their opt-out pages, a maintained guide saves a lot of time.

Common pitfalls

Giving away more than you need to. Some opt-out forms ask for an email, phone number, or even ID. Use an email alias (see 9.2-reducing-personal-exposure.md), give only what’s required, and redact anything on an ID that isn’t needed (such as the ID number and photo, if the site allows).
Missing duplicate listings. If you’ve lived at several addresses or go by different names, you may have several listings on the same site.
Affiliated sites. Many people-search sites share the same back-end data. Removing yourself from one may or may not remove you from its sister sites. Check each one.
Relatives’ listings. Even after you opt out, your name may still appear as a “relative” on family members’ listings.
Fake or upsell “removal” pages. Never pay a people-search site to remove your own information, and be careful of look-alike opt-out pages.
Data comes back. When the broker gets new records (you move, you sign up for something), a new listing can appear. Re-check regularly.
It takes time. Individual opt-outs can take days to weeks to process, and doing dozens of sites by hand takes hours.

Paid Removal Services

Paid services submit opt-out requests on your behalf and re-check periodically. Well-known examples include DeleteMe, Optery, Incogni, EasyOptOuts, and Kanary.

What to know:
- Pricing and coverage vary and change often. Plans generally range from a few dollars a month to a couple hundred dollars a year, and each service claims coverage of a different number of brokers. Check current pricing before recommending one.
- Some offer free scans. Optery, for example, offers a free tier that shows where you’re exposed before you pay.
- Coverage numbers aren’t the whole story. What matters is whether your data actually stays removed.

What independent research found

In August 2024, Consumer Reports published Data Defense: Evaluating People-Search Site Removal Services:
- 32 volunteers, 7 paid removal services, 13 people-search sites, tracked over 4 months
- Manual opt-outs were the most effective, with 70% of listings gone within a week
- The best-performing paid services were Optery (68%) and EasyOptOuts (65%) after four months
- The worst performers removed only a small fraction (single-digit percentages)
- Overall, only about a third of the personal information the services found stayed removed (per The Record’s coverage)
- Every participant still had information on some of the 13 sites at every check
- Researchers also flagged business relationships between some removal services and people-search sites, which raises conflict-of-interest questions

How to choose (if you choose one)

Does it provide proof of each removal (for example, screenshots)?
Does it re-scan regularly and re-submit when listings reappear?
Can you request custom removals for sites it doesn’t cover automatically?
What information does it need from you, and how does it protect it?
Does it disclose any partnerships with the brokers it removes you from?

A reasonable approach for most students: manually opt out of the highest-priority sites first, and consider a paid service only if you need broader, ongoing coverage.

Laws That Help

California: CCPA/CPRA

California residents have the right to know what data businesses collect about them, to request deletion, and to opt out of the sale or sharing of their data.

California: The Delete Act and DROP

The Delete Act (SB 362, 2023) created a registry of data brokers and required the state to build a single deletion tool. That tool is DROP (Delete Request and Opt-Out Platform), run by the California Privacy Protection Agency (now branded CalPrivacy).

Date	What happened
January 1, 2026	DROP opened to consumers. California residents can verify their residency and submit one deletion request that goes to every registered data broker (500+ at launch).
August 1, 2026	Registered data brokers must start processing DROP requests, checking the platform at least once every 45 days, and deleting the associated personal information.

Penalties: brokers face $200 per day, per deletion request they fail to process, plus investigation costs. Failing to register also carries a $200/day penalty.
Uptake: industry coverage reported that hundreds of thousands of Californians had submitted requests by spring 2026 (verify the current figure before class).
Where to start: privacy.ca.gov.
Limits: DROP only helps California residents, only covers registered data brokers (businesses that sell data about people they don’t have a direct relationship with), and doesn’t remove public records at the source.

This is a big shift: instead of hundreds of individual opt-outs, one request reaches every registered broker, and brokers must keep honoring it.

Other US states

Several other states (for example, Vermont, Texas, and Oregon) have data broker registration laws (verify current details before class).
A growing number of states have comprehensive privacy laws that include a right to delete.
Laws like New Jersey’s Daniel’s Law protect specific groups (judges, law enforcement) from having home addresses published.

Outside the US

The EU’s GDPR includes a right to erasure (Article 17), sometimes called the “right to be forgotten,” which applies to personal data even if it’s publicly available.

Realistic Expectations

You can’t get to zero. Public records stay public, and new data keeps flowing to brokers.
Removal is a process, not an event. Plan to re-check every few months.
Prioritize. Focus first on the sites that show your home address and phone number.
Reduce the inflow. Use email aliases, avoid giving your real phone number, and skip optional sign-ups and loyalty programs you don’t need. Less new data means fewer new listings.
Combine approaches. Opt-outs + DROP (if you’re in California) + monitoring (see 9.5-monitoring-and-early-warning.md) + good personal habits.

Key Terms

Data broker: a business that collects and sells personal information about people it doesn’t have a direct relationship with.
People-search site: a consumer-facing data broker that displays profiles of individuals.
Opt-out: a request to stop a company from showing, selling, or sharing your data.
Delete Act (SB 362): California law creating a data broker registry and a central deletion mechanism.
DROP: California’s Delete Request and Opt-Out Platform; one request reaches all registered data brokers.
Right to erasure: the GDPR right to have personal data deleted.
Daniel’s Law: New Jersey law protecting the home addresses of judges, law enforcement, and others.

Key Takeaways

Data brokers do the aggregation for attackers: addresses, phones, relatives, all in one place.
The Judge Esther Salas case shows the real-world stakes of exposed home addresses.
Manual opt-outs work best (70% gone within a week in Consumer Reports’ 2024 study) but take time.
Paid services vary widely in effectiveness; check independent research before paying.
California’s DROP lets residents send one deletion request to every registered broker; brokers must process them starting August 1, 2026.
Data comes back. Re-check every few months and reduce new data at the source.

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.