State Privacy Laws
Your state may give you legal rights to force data brokers to delete your personal information. These rights matter because they turn a polite request into a legal obligation — brokers that ignore opt-outs from residents of states with privacy laws risk enforcement actions and fines.
Even if your state is not listed here, most data brokers honor opt-out requests from all US residents. But knowing your legal rights gives you stronger language for your requests and a path to escalation if a broker does not comply.
California
CCPA / CPRA
California Consumer Privacy Act / California Privacy Rights Act
Key rights
- Right to know what personal data is collected
- Right to delete personal data
- Right to opt out of the sale or sharing of personal data
- Right to correct inaccurate personal data
- Right to limit use of sensitive personal information
- Private right of action for data breaches
What this means for data broker removal
California has the strongest data broker protections in the US. The CPRA created the California Privacy Protection Agency to enforce these rights. Data brokers operating in California must register with the state and honor deletion requests within 45 days. If a broker ignores your opt-out, you can file a complaint with the CPPA — and they actually investigate.
Colorado
CPA
Colorado Privacy Act
Key rights
- Right to access personal data
- Right to delete personal data
- Right to correct inaccurate data
- Right to opt out of targeted advertising
- Right to opt out of the sale of personal data
- Right to opt out of profiling
What this means for data broker removal
Colorado's law applies to businesses that process data of 100,000+ consumers or derive revenue from selling data of 25,000+ consumers. Most major data brokers meet this threshold. Colorado also recognizes universal opt-out mechanisms, meaning browsers and extensions that signal opt-out preferences must be honored by brokers.
Connecticut
CTDPA
Connecticut Data Privacy Act
Key rights
- Right to access personal data
- Right to delete personal data
- Right to correct inaccurate data
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
- Right to opt out of profiling
What this means for data broker removal
Connecticut's law is closely modeled on Colorado's and provides similar protections. It also recognizes universal opt-out signals. Data brokers must respond to deletion requests within 45 days. Connecticut residents can cite the CTDPA when requesting removal from any broker that processes Connecticut consumer data.
Virginia
VCDPA
Virginia Consumer Data Protection Act
Key rights
- Right to access personal data
- Right to delete personal data
- Right to correct inaccurate data
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
- Right to opt out of profiling
What this means for data broker removal
Virginia was the second state after California to pass a comprehensive privacy law. The VCDPA requires brokers to process deletion requests within 45 days and provides an appeal mechanism if a request is denied. While enforcement is through the Attorney General rather than a private right of action, citing the VCDPA in your opt-out request adds legal weight.
Utah
UCPA
Utah Consumer Privacy Act
Key rights
- Right to access personal data
- Right to delete personal data provided by the consumer
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
What this means for data broker removal
Utah's law is more business-friendly than California's or Colorado's — the deletion right only covers data you provided directly, not data the broker inferred or obtained from third parties. However, the opt-out-of-sale right is still valuable for data broker removal. Brokers must honor your opt-out within 45 days.
Oregon
OCPA
Oregon Consumer Privacy Act
Key rights
- Right to access personal data
- Right to delete personal data
- Right to correct inaccurate data
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
- Right to opt out of profiling
What this means for data broker removal
Oregon's law stands out for its broad definition of personal data, which includes derived and inferred data — not just information you directly provided. This is significant for data broker removal because brokers often claim they "inferred" your data rather than collected it. Oregon also has no revenue threshold, meaning it applies to more businesses than many other state laws.
Montana
MCDPA
Montana Consumer Data Privacy Act
Key rights
- Right to access personal data
- Right to delete personal data
- Right to correct inaccurate data
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
What this means for data broker removal
Montana's law has the lowest population threshold in the country — it applies to businesses that process data of just 50,000 consumers (most states set 100,000). This means more data brokers fall under Montana's jurisdiction. The practical impact: Montana residents can cite the MCDPA against brokers that might claim to be too small for other state laws.
Texas
TDPSA
Texas Data Privacy and Security Act
Key rights
- Right to access personal data
- Right to delete personal data
- Right to correct inaccurate data
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
- Right to opt out of profiling
What this means for data broker removal
Texas is notable because the TDPSA has no revenue threshold and no minimum number of consumers processed. It applies to any business conducting operations in Texas that processes personal data, making it one of the broadest state privacy laws by applicability. Given Texas's large population, most national data brokers are covered. The AG can impose fines up to $7,500 per violation.
Delaware
DPDPA
Delaware Personal Data Privacy Act
Key rights
- Right to access personal data
- Right to delete personal data
- Right to correct inaccurate data
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
- Right to opt out of profiling
What this means for data broker removal
Delaware's law provides broad protections similar to Oregon's, including coverage of inferred data. It applies to businesses processing data of 35,000+ consumers (or 10,000+ if revenue is derived from data sales) — a relatively low threshold that captures most data brokers. Delaware also requires businesses to recognize universal opt-out mechanisms.
Iowa
ICDPA
Iowa Consumer Data Protection Act
Key rights
- Right to access personal data
- Right to delete personal data
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
What this means for data broker removal
Iowa's law is more limited than some other states — it does not include a right to correct data or opt out of profiling. However, the core deletion and opt-out-of-sale rights still apply to data brokers. Brokers must respond within 90 days, which is longer than the 45-day standard in other states.
Indiana
INCDPA
Indiana Consumer Data Protection Act
Key rights
- Right to access personal data
- Right to delete personal data
- Right to correct inaccurate data
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
- Right to opt out of profiling
What this means for data broker removal
Indiana's law follows the Virginia model closely. It applies to businesses processing data of 100,000+ consumers or those deriving revenue from data sales of 25,000+ consumers. Indiana residents can use the INCDPA to strengthen their opt-out requests with major data brokers.
Tennessee
TIPA
Tennessee Information Protection Act
Key rights
- Right to access personal data
- Right to delete personal data
- Right to correct inaccurate data
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
- Right to opt out of profiling
What this means for data broker removal
Tennessee's law includes an affirmative defense for businesses that maintain and comply with a written privacy program — a unique feature. However, data brokers that ignore opt-out requests cannot claim this defense. Tennessee residents should cite the TIPA when submitting removal requests to brokers that process Tennessee consumer data.
Florida
FDBR
Florida Digital Bill of Rights
Key rights
- Right to access personal data
- Right to delete personal data
- Right to correct inaccurate data
- Right to opt out of the sale of personal data
- Right to opt out of targeted advertising
- Right to opt out of profiling
What this means for data broker removal
Florida's law has a high applicability threshold — it only covers businesses with over $1 billion in revenue or those that operate large data platforms. This means it applies to the biggest data brokers (like Acxiom, Oracle Data Cloud, and LexisNexis) but may not cover smaller people-search sites. Florida residents should still cite it when opting out of major brokers.
What if my state is not listed?
Most data brokers honor opt-out requests regardless of your state of residence. The brokers in our directory have publicly available opt-out processes that work for anyone. A state privacy law gives you a stronger legal basis, but it is not required to submit an opt-out request.
Privacy legislation is moving quickly. Several additional states have passed laws that take effect in 2025 and 2026, including New Hampshire, New Jersey, Maryland, Minnesota, Nebraska, and Kentucky. We update this page as new laws become effective.
Know your rights. Use them.
Run a free exposure check to see which data brokers are most likely to have your information, then follow our verified guides to opt out.