A breach exposed your name, address, and phone number, and you want to reduce how easily someone can build a fuller profile of you using data broker and people-search sites.
What a data broker actually has on you
Data brokers and people-search sites build profiles from public records — property deeds, voter files, court filings — and purchased marketing data, then sell lookups of that profile to anyone who searches your name. A typical listing includes your current and past addresses, your age, phone numbers, email addresses, and the names of relatives and known associates.
None of that is stolen data in the way a breach is. It's compiled from records that are, individually, public or commercially available. The problem is that no single public record puts all of it in one place the way a broker's profile does.
Why this matters more right after a breach
A breach typically hands a criminal a piece of hard identity data — a Social Security number, an account number, a login. A broker profile hands them the surrounding context: your mother's maiden name or a past address that a bank's security question might ask about, a current phone number to target with a SIM-swap attempt, or a relative's name to use in a social-engineering call pretending to be you.
Combining the two is what turns a data breach into a successful account takeover. Reducing your broker footprint doesn't undo the original breach, but it removes some of the raw material a criminal would use to get past the next layer of verification.
Two ways to opt out
There are two practical paths: opt out of each broker's own listing individually, using the removal form most brokers are legally required to post on their own site, or — if you're a California resident — submit one request through the state's new centralized platform.
Manual opt-outs are free but repetitive, since brokers routinely repopulate profiles from the same public records months later, meaning this isn't a one-time task if you want to stay off these sites long-term.
California's DROP platform
California's Delete Act created the Delete Request and Opt-Out Platform, run by the California Privacy Protection Agency, which opened to consumers on January 1, 2026. It lets a California resident submit a single deletion request that is meant to reach every data broker registered with the state — several hundred brokers — rather than filing a separate request with each one.
Registered brokers are required to check the platform at least every 45 days starting August 1, 2026, and process any pending deletion requests they find. If you live in California, this is the most efficient starting point; residents of other states currently have to rely on each broker's individual opt-out process, since no equivalent national platform exists yet.
What to have ready for a manual opt-out
Most broker opt-out forms ask for the minimum needed to locate and confirm your specific listing:
- Your full name, including past names if a listing might be under one
- A current or recent address, to distinguish you from someone with the same name
- An email address to confirm the removal request (many brokers send a confirmation link)
- The direct URL of the specific listing you found, if you were able to search and locate it
Be careful what you don't hand over
A legitimate opt-out should never require your Social Security number, a copy of a government ID, or payment information — brokers only need enough to confirm which listing is yours. If a site's opt-out process asks for more than a name, address, and email to verify identity, treat that as a red flag rather than a normal step, and consider whether the site itself is trustworthy.
Automated paid removal services exist and repeat the opt-out process for you across many brokers on an ongoing basis, since listings do reappear — that's a convenience trade-off, not a requirement, and doing the same removals yourself for free is entirely workable if you're willing to repeat it periodically.
This doesn't replace freezing your credit
Opting out of data brokers reduces the context available for social engineering; it does nothing to stop someone who already has your Social Security number from opening a new account in your name. If your breach involved an SSN, account number, or driver's license number, a credit freeze at all three bureaus is the step that actually blocks new-account fraud — treat broker opt-outs as an addition to that, not a substitute for it.
The kinds of sites this typically means
“Data broker” covers a wide range of businesses, but the ones most people mean when they talk about opting out are people-search sites — the kind that return a name, address history, age, phone numbers, and relatives when you search someone's name. Well-known examples in this category include Spokeo, Whitepages, BeenVerified, MyLife, and Radaris, among many others; there is no single list that covers every broker, which is exactly the problem California's DROP platform is meant to solve for state residents.
A second, less visible category is marketing and advertising data brokers, who compile purchase history and inferred interests rather than a searchable public profile — these matter less for the immediate social-engineering risk after a breach and more for general privacy, so they're a lower priority if your goal is specifically reducing post-breach account-takeover risk.
Frequently asked questions about broker opt-outs
- Will opting out remove me permanently? Not usually — brokers rebuild profiles from the same underlying public records, so a listing can reappear months later even after a successful opt-out, which is why this is an ongoing task rather than a one-time fix.
- Does opting out cost anything? Manually opting out directly with each broker is free. Paid removal services exist to repeat the process on your behalf on an ongoing basis, which is a convenience, not a requirement.
- Is California's DROP platform available to residents of other states? No — it's specific to California residents under the state's Delete Act; residents elsewhere currently have to use each broker's individual opt-out process until, or unless, a similar platform exists in their own state.
- Do I need to opt out of every broker to see a meaningful effect? Prioritize the handful of well-known people-search sites first, since they're the ones most likely to surface in a quick search of your name — that's where most of the practical social-engineering risk described here actually comes from.
After a breach exposed your phone number and old addresses
A breach notice says your name, phone number, and a past home address were exposed. Searching your own name on a couple of well-known people-search sites turns up a fuller profile than you expected — current address, a family member's name, and a second phone number you'd forgotten you'd used years ago.
You go through each site's own opt-out form, submitting your name and current address and confirming each removal by email. If you're a California resident, you also submit one request through the state's centralized platform, which is meant to reach the broader set of registered brokers you didn't individually search. You set a reminder to search your name again in a few months, since new listings can resurface from the same underlying public records.
