Data Broker Opt-Out Laws Exist in a Dozen States — Most Deletion Requests Still Get Ignored
California's Delete Act was supposed to fix the most tedious part of exercising a privacy right: having to contact dozens of data brokers individually to ask them to delete your information. Instead, two years of data show a different story — brokers are receiving the requests and simply refusing most of them.
According to filings analyzed by data broker tracking service Control D, California's 603 registered data brokers received 58 million deletion requests in 2024 and denied 890,712 of them outright. That's not brokers failing to respond — that's brokers actively reviewing requests and saying no. Bloomberg Law reported separately that brokers denied or ignored more than a million deletion requests over the two-year period the Delete Act has been in effect, with some brokers acknowledging rejection rates close to 100% of what they received.
How DROP Was Supposed to Work
The Delete and Opt-Out Platform, DROP, is a single portal where a California resident can submit one deletion request that broadcasts to every registered broker in the state, instead of filing 603 separate requests by hand. It's a genuinely useful piece of civic infrastructure — the kind of centralization that privacy advocates have wanted for years. The catch is enforcement. Brokers are required to check DROP for new requests and act on them at least once every 45 days. For the first 45-day compliance window, which closed in mid-September 2026, a broker that simply logged in, saw the request, and declined to delete anything was technically compliant with the process, even if it was non-compliant with the substance.
California did add teeth starting August 1, 2026: a $200-per-day penalty for each unprocessed deletion request. That's a real financial lever once the state's privacy enforcement unit starts applying it — but penalties for ignoring a request are different from penalties for denying one, and brokers denying requests outright sidesteps the fine entirely. A broker that says "we reviewed your request and declined" has processed the request. Whether the denial was lawful is a separate legal question that nobody is systematically checking.
Why Brokers Deny Requests
The most common legal basis brokers cite is that deletion conflicts with another legal obligation — fraud prevention, credit reporting requirements, or litigation holds are typical justifications. Some of these are legitimate. A credit bureau genuinely can't delete records that federal law requires it to retain for seven years. But the opacity is the problem: there's no public registry of denial reasons, no auditor cross-checking whether a denial claim is accurate, and no meaningful penalty specifically tied to a false or pretextual denial. A broker has every incentive to cite an exemption and very little risk of being challenged on it.
Oregon and Texas Show the Deeper Flaw
California's problem is brokers gaming a functioning system. Oregon and Texas have a more basic problem: most brokers aren't in the system at all. A 2025 Privacy Rights Clearinghouse analysis found Oregon's broker registry listed roughly 292 companies and Texas listed about 207 — against an estimated 750 brokers actually operating nationally. A broker that never registers is invisible to state enforcement. It can't be fined for ignoring deletion requests because, as far as the state's registry is concerned, it doesn't exist. Unlike California, which built a unified platform, Oregon's and Texas's laws rely on the broker voluntarily registering and self-reporting compliance.
What This Means If You've Actually Tried to Opt Out
If you submitted deletion requests through DROP and got a denial, the denial letter is the thing worth keeping. It names a specific legal exemption, which means it's a specific, checkable claim — not a generic refusal. State attorneys general in California, Oregon, Colorado, and Texas all accept consumer complaints about privacy law violations, and a pattern of denials citing the same exemption across unrelated requests is exactly the kind of evidence that triggers an investigation, not an individual complaint.
The more durable fix isn't a better portal — California already built a good one. It's extending per-request financial penalties to improper denials specifically, not just to non-response, and building reciprocal registries so an unregistered broker caught operating in Oregon or Texas faces consequences comparable to what an unregistered broker in California would face. Until state legislatures close that gap, the practical lesson for consumers is that an opt-out registry only protects you from the brokers who bothered to register in the first place — and roughly two-thirds of them, by Oregon and Texas's own numbers, haven't.