35 Data Brokers with Non-Indexed Opt-Out Pages

A data broker can add a noindex meta tag to the HTML of its privacy/opt-out page, include that URL in robots.txt with "Disallow:", or use an X-Robots-Tag HTTP header. These signals can prevent search engines like Google from indexing the page. The page may still exist, but the provider route and legal significance must be checked as of the current date; a dataset flag does not establish intent or a violation.

Whether a non-indexed opt-out page violates privacy law depends on the current statute, implementing rules, provider facts, and the actual access path. California’s rules address how opt-out methods must be provided and designed; the reviewed technical signal alone does not prove a legal violation. Check current CPPA guidance before drawing a compliance conclusion.

The Markup and CalMatters reported that their 2025 review checked all 499 records in the captured California data-broker dataset for three technical signals: (1) a noindex meta tag in HTML, (2) an X-Robots-Tag HTTP header with noindex, and (3) robots.txt restrictions on the specific opt-out URL. The local snapshot preserves the dataset's "hiding_found=TRUE" field; it is not a current crawl.

The captured dataset contains 11 flagged rows with a "hiding_stopped_confirmed_at" date. That is a field in the historical source snapshot, not an independent current re-crawl by OfflistMe; check the provider route and date before relying on it.

Three steps. (1) Open the recorded URL from this page’s table and verify that it still loads and belongs to the provider. (2) If it fails, use the broker’s current privacy contact from the California data-broker materials at cppa.ca.gov/data_brokers. (3) If appropriate, file a complaint with the California Privacy Protection Agency and describe the dated technical finding.

Across the full 499-record dataset, 80 rows carry a location-data label, 10 carry a reproductive-health-adjacent label, and 16 carry an information-on-minors label. These are source-dataset fields, not a legal-risk score or proof that a provider violated privacy law.