Data Broker Opt-Out Checklist: Evidence-First Tracking Template (2026)

Opting out is repetitive because providers use different records, routes, verification, scopes, and response systems. A checklist helps you preserve evidence and avoid sending personal information to a stale or unrelated destination.

This is a workflow template, not a claim that a fixed list, timeline, or number of sites applies to every person.

Quick checklist

• [ ] Define the risk: home address, phone, email, workplace, family links, court record, professional profile, or another exposure.
• [ ] Search your name, location, phone, email, and common name variants.
• [ ] Confirm each matching profile using more than one non-sensitive detail.
• [ ] Open the provider's current first-party privacy or suppression route.
• [ ] Record the URL and source date before submitting.
• [ ] Choose deletion, correction, access, objection, suppression, or search-result handling as appropriate.
• [ ] Submit only the information reasonably needed for matching and verification.
• [ ] Save the confirmation, response, and appeal instructions privately.
• [ ] Re-check the exact source URL after any provider-stated window, if one is published, or after a documented follow-up date you choose.
• [ ] Handle Google and other search engines separately from the source record.
• [ ] Re-check important sources when your risk, address, or public-record activity changes.

Before you start

1. Choose a safe contact method

Use a mailbox you control and are comfortable using for privacy requests. Do not create a public tracker containing your name, address, phone, email, profile URLs, or request bodies. OfflistMe's opt-out drafting workflow is browser-local; the user decides what to send and keeps the request evidence.

2. Create a private tracker

Use one row per provider or exact source:

3. Minimize the information you share

Read the current notice and provide only what is reasonably needed to match the record. Government IDs, utility bills, full birth dates, and account credentials are sensitive. Do not assume redaction will be accepted, and do not upload a document until you understand why it is requested and how it is handled.

Phase 1: Find and prioritize matching sources

Search your name with your city, former cities, phone, email, workplace, and common spelling variants. Look for:

• a live people-search profile;
• a home address or historical address;
• a personal or direct-dial phone number;
• relatives or household links;
• a professional profile that exposes a personal contact method;
• an inaccurate court, property, or identity record; or
• a source that creates a specific safety risk.

Start with sources that actually match you and expose the highest-risk information. A “top ten” list or search position is only a discovery aid, not a verified priority order.

Phase 2: Verify the first-party route

Use the provider's current privacy policy, request portal, support page, or published contact route. Confirm:

• the domain is genuine;
• the operator or legal entity is identified;
• the route applies to the product showing your record;
• the request scope is clear;
• the verification requirement is stated; and
• any processing estimate is dated and provider-specific.

Do not rely on an old URL copied from a forum. If the route changed, record the new page and its source date.

Phase 3: Submit and save evidence

After submitting:

1. Save the confirmation or reference number.
2. Keep a copy of the exact request and date.
3. Record any verification email, phone step, or document request.
4. Note the provider's stated response or processing guidance.
5. Keep any written explanation for a denial or exception.

An automated acknowledgement proves receipt of a message, not deletion. An internal status badge proves what the provider reports, not necessarily what the live source displays.

Phase 4: Verify the outcome

Check the exact profile URL after any provider-stated window, if one is published. If no window is published, choose a follow-up date based on the source, risk, and evidence you have. Record one of these statuses:

• Removed: the source no longer displays the matching profile;
• Changed: some fields changed but the source remains;
• Still live: the matching profile remains;
• Not found: the URL or search no longer returns a result, but the reason is unknown; or
• Unknown: you cannot safely verify the result.

Then review search-engine results separately. Google says eligible requests can affect Search results, not the source website. If a page changed or was deleted, Google's refresh guidance addresses outdated result text or cache. A Search-result request or refresh does not delete the source record.

Phase 5: Follow up or appeal

If the source remains live, use the provider's current follow-up or appeal route. Cite the original request date and attach only the evidence needed to identify it. If a privacy law applies, check the regulator's current deadline, extensions, verification rules, exemptions, and complaint process.

There is no universal response or reappearance timeline. Do not tell a user that a provider must respond within a fixed period unless the specific law and request actually support that statement.

B2B and specialist sources

Work contact, marketing, credit, fraud, healthcare-adjacent, licensing, and identity-resolution providers may require different routes from people-search sites. Search the provider's current privacy center and ask whether the request is for:

• a public profile;
• a professional contact record;
• a marketing segment;
• a consumer report;
• a risk or identity signal; or
• a record maintained for a client.

If the source may be a consumer reporting agency, read the applicable FCRA dispute and permissible-purpose guidance rather than using a generic people-search template. For a professional contact profile, review the SignalHire opt-out guide separately from consumer people-search requests.

California DROP and other legal mechanisms

California residents can consult the CPPA's current data-broker instructions and DROP consumer guidance. CPPA describes DROP as a single deletion request for active data brokers; it says data brokers must begin processing requests on August 1, 2026 and access DROP at least every 45 days, subject to the applicable law and exceptions. DROP and an individual provider request are separate routes. A state portal does not automatically remove an original public record, an unrelated website, or a Google Search result.

Other jurisdictions have different rights, thresholds, deadlines, and exceptions. Use the relevant regulator or statute and do not describe one state's right as nationwide.

For plain-English state-law references, see the New Jersey Data Protection Act, Connecticut's CTDPA, and the Nebraska Data Privacy Act. For Canadian private-sector context, see PIPEDA, Canada's federal privacy law and the Quebec Law 25 glossary entry.

For the full provider-by-provider workflow, use how to remove your data from data brokers after identifying the matching sources.

How OfflistMe fits

The rendered OfflistMe counts are a dated product-inventory snapshot: 1,034 recorded workflow profiles within a 1,052-record research catalog. They describe catalog and research inventory, not a count of matching profiles, legal coverage, or completed outcomes, and they can change as the underlying records are reviewed.

The app can show a recorded route and prepare a browser-local draft for your review. You send or submit it through the provider's route, complete verification, and record the response. It does not automatically submit every request, bypass provider controls, or guarantee deletion.

Review the directory →

Re-check plan

Choose a schedule based on your risk:

Do not claim that all providers refresh on a 60-, 90-, or 180-day cycle. Record what you observe and update the schedule when evidence changes.

Frequently asked questions

Do I need to opt out of every provider in a directory?

No. Start with matching and high-risk sources, then expand as your evidence and risk justify it. A directory count does not show that every provider has a profile about you.

What if the opt-out link is missing?

Search the provider's current privacy notice, support page, or legal entity contact route. Save the page and date. Do not invent an email address from a naming pattern.

Can a related brand be covered by one request?

Only when the provider's current instructions clearly state the scope. Treat each brand as separate until the provider documents otherwise.

Should I use a throwaway email address?

Use a contact method you control and are comfortable sharing. A new address may help organization, but it is not a privacy guarantee and can create matching or verification issues.

What is the evidence-ready definition of “done”?

At minimum, you should have the source URL, request date, provider response, and a dated re-check result. “Done” should describe the observed source status, not a promise about every copy or future publication.

Sources

Reviewed August 25, 2026. The sources below support the bounded California, people-search, FCRA, Google Search, and product-boundary statements in this guide. Provider route availability, eligibility, verification, response or processing timing, and outcomes remain provider- and request-specific; no provider submission or outcome test was performed.

• California Privacy Protection Agency: Information for Data Brokers
• California Privacy Protection Agency: Data Broker Registry
• California Privacy Protection Agency: DROP for consumers
• FTC: What to know about people-search sites
• FTC: Employer background checks and your rights
• FTC: Tenant background checks and your rights
• Google Search Help: Remove my private info
• Google Search Help: Results about you
• Google Search Help: Refresh outdated content
• Privacy Rights Clearinghouse: Data brokers
• OfflistMe Privacy Policy