A B C D E F G H I J K L M N O P Q R S T U V W X Y Z #

Your Privacy Rights by State (and How to Use Them)

Opt-out forms are a courtesy. Privacy laws are an obligation — and citing the right one turns a request a company can ignore into one it has to answer.

Which law covers you

  1. California (CCPA/CPRA) — the strongest: right to know, delete, correct, and opt out of sale. Plus the DROP platform, which hits 600+ registered brokers in one request.
  2. Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware and a growing list — comprehensive laws with deletion and opt-out rights; deadlines are typically 45 days, extendable once.
  3. Everywhere in the US — no comprehensive federal law, but sector rules still apply: HIPAA for health data, FCRA for background-check and credit data, and the FTC Act for deceptive practices.
  4. EU/UK (GDPR) — the right to erasure, one month to respond, and it applies to any company that targets EU/UK users regardless of where the company sits.

How to write a request that gets actioned

Keep it short and make the legal basis explicit:

“I am a resident of [state]. Under [the CCPA / Colorado Privacy Act / GDPR Article 17], I request deletion of all personal information you hold about me, and that you cease selling or sharing it. My details: [name, address, email]. The listing is at [URL]. Please confirm in writing within the statutory deadline.”

Send it to the privacy address in the site’s privacy policy, keep a copy, and note the date.

When they ignore you

  1. Follow up once in writing, referencing your original date.
  2. File a complaint with your state attorney general — this is free, takes minutes, and companies respond to it far faster than to you.
  3. Californians can complain to the California Privacy Protection Agency, which has actual enforcement power over data brokers.
  4. File with the FTC at reportfraud.ftc.gov for a pattern of ignored requests.
  5. For background-check and credit data, the CFPB takes complaints under the FCRA and gets fast results.

Complaints matter more than they feel like they do. Data-broker enforcement actions typically start with a pile of individual complaints.