35 Data Brokers Caught Hiding Their Opt-Out Pages from Google

A data broker can add a noindex meta tag to the HTML of its privacy/opt-out page, or include that URL in robots.txt with "Disallow:", or use an X-Robots-Tag HTTP header. Any of these tells search engines like Google not to index the page. The page still exists technically, but consumers searching for "[broker name] opt out" will not find it via Google. Under California’s Delete Act, this is now a potential regulatory violation.

The California AG and CPPA have signalled that deliberately concealing opt-out methods can violate CCPA’s "design requirements" — opt-out mechanisms must be "easy to execute" and cannot involve "difficult, time-consuming, or confusing" steps. SB 362 (the Delete Act, effective August 2026) tightens this further by requiring broker opt-out pages to be accessible and discoverable.

The Markup and CalMatters jointly investigated every California-registered data broker by fetching their opt-out/privacy pages and checking three technical signals: (1) noindex meta tag in HTML, (2) X-Robots-Tag HTTP header with noindex, and (3) robots.txt restrictions on the specific opt-out URL. Brokers returning any of these received a "hiding_found=TRUE" flag.

At least 11 of the 35 brokers originally caught hiding their opt-out pages were subsequently confirmed to have removed the noindex tag or robots.txt restriction. The Markup’s dataset tracks this as a "hiding_stopped_confirmed_at" timestamp.

Three steps. (1) Use the direct URL from this page’s table, which bypasses the fact that Google doesn’t index it. (2) If that fails, email the broker’s privacy contact from the California Data Broker Registry at cppa.ca.gov/data_broker_registry. (3) File a complaint with the California Privacy Protection Agency citing CCPA design requirements.

Across the full 499-broker dataset, 80 collect precise location data, 10 collect reproductive-health-adjacent data, and 16 collect information on minors. The combination of sensitive data and hidden opt-out pages raises the compliance-risk profile significantly.