You submitted an opt-out request weeks ago, but your personal information is still plastered across a data broker's website. What now? When a data broker ignores your deletion request or refuses to comply with privacy laws, filing a formal complaint with the right government agency can force action. Here is exactly how to do it, step by step.
Why Filing a Complaint Matters
Data brokers profit from collecting and selling your personal information, including your name, home address, phone number, email, relatives' names, income estimates, and more. Federal and state privacy laws give you the right to request deletion of this data, and brokers are legally required to comply within set timeframes. When they do not, a formal complaint creates an official record that regulators use to investigate, fine, and sometimes shut down non-compliant companies.
Filing complaints is not just about your individual case. Regulators like the FTC and state attorneys general use complaint volume to identify patterns and prioritize enforcement. Your complaint may be the one that triggers an investigation affecting millions of consumers.
Know Your Rights Before You File
Under the California Consumer Privacy Act (CCPA), data brokers must respond to deletion requests within 45 days. The Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, and Texas Data Privacy and Security Act grant similar rights. At the federal level, the FTC can pursue data brokers for unfair or deceptive practices. Understanding which law applies to you strengthens your complaint significantly.
Step 1: Document Everything
Before you file a complaint, gather your evidence. This documentation will make your complaint far more effective and give regulators the specifics they need to act.
- Screenshots of your personal information on the broker's website, with dates
- Copies of your opt-out or deletion requests, including confirmation emails or reference numbers
- A timeline showing when you submitted your request and how long the broker has had to respond
- Any correspondence from the broker, including automated replies, denials, or silence
- The broker's privacy policy URL, which may contain language about response times or applicable laws
Step 2: File with the Federal Trade Commission (FTC)
The FTC is the primary federal agency responsible for protecting consumers from unfair or deceptive business practices, including data broker violations. While the FTC does not resolve individual complaints directly, it uses them to build enforcement cases.
How to file
- Visit ReportFraud.ftc.gov
- Select the category that best describes your issue (typically "Something Else" and then describe the data broker situation)
- Provide details about the company, what happened, and what data is involved
- Include your documentation and any reference numbers from your original opt-out request
Your complaint enters the Consumer Sentinel Network, a secure database accessible to more than 3,000 law enforcement agencies, including the FBI, state attorneys general, and international partners. You can also call 1-877-FTC-HELP (1-877-382-4357) to file by phone.
Step 3: File with the Consumer Financial Protection Bureau (CFPB)
If the data broker deals in financial data, such as credit header information, income data, or banking details, the CFPB may be a more effective option. The CFPB has a significant advantage over the FTC: it forwards your complaint directly to the company, which is required to respond within 15 days.
How to file
- Visit consumerfinance.gov/complaint
- Choose the product or service category closest to your issue
- Describe what happened in detail, including dates and your prior attempts to resolve the issue
- Submit your supporting documents
The CFPB tracks company response rates publicly, which means non-responsive companies face both regulatory and reputational consequences.
Skip the manual opt-outs
One opt-out won't stop them — brokers relist your data. PrivacyOn removes your info from 100+ sites and keeps it removed.
See where you're exposed — free 60-second scanStep 4: File with Your State Attorney General
Your state attorney general has direct enforcement power within your state and can pursue civil action against non-compliant data brokers. Many states now have dedicated consumer privacy divisions.
Key state resources
- California: The California Privacy Protection Agency (CPPA) launched a Data Broker Enforcement Strike Force in late 2025, with over 100 active investigations. File at privacy.ca.gov
- Texas: The Texas Data Broker Act requires all data brokers to register with the Secretary of State. File complaints with the Attorney General's Consumer Protection Division at texasattorneygeneral.gov
- Virginia: File at oag.state.va.us under consumer protection
- Colorado: File at stopfraudcolorado.gov
For other states, visit the National Association of Attorneys General (NAAG) website to find your state's consumer complaint portal.
Do Not Wait Too Long to File
Some state privacy laws have statutes of limitations on complaints, and evidence like screenshots and emails can be lost over time. If a data broker has not honored your opt-out request within the legally required window (typically 30 to 45 days), file your complaint promptly. The sooner regulators hear from you, the sooner they can act.
Step 5: Use California's DROP Portal (California Residents)
California residents now have access to a powerful new tool. The Delete Request and Opt-Out Platform (DROP), which launched in January 2026 under the Delete Act, allows you to submit a single deletion request that is sent to all registered data brokers in the state. Beginning August 1, 2026, data brokers are required to check DROP at least once every 45 days, process deletion requests, and report their status back to the CPPA.
To use DROP, visit privacy.ca.gov, verify your California residency, create a profile, and submit your request. You can provide additional identifiers like name variations, phone numbers, and date of birth to help brokers locate your records. You can also return at any time to check your deletion status.
What Happens After You File
After you submit a complaint, here is what to expect:
- FTC: Your complaint is logged into the Consumer Sentinel database. The FTC does not resolve individual cases but uses complaint data to identify companies for enforcement action. Major FTC actions in recent years have resulted in millions of dollars in fines against data brokers.
- CFPB: The company receives your complaint and must respond within 15 days. You can track the status through the CFPB's online portal and dispute the response if it is unsatisfactory.
- State AG: Response times vary by state. Some attorneys general mediate individual disputes; others use complaints to build larger investigations. California's CPPA has been particularly aggressive, with enforcement actions including six-figure and seven-figure fines against non-compliant companies.
File with Multiple Agencies
There is no rule against filing with more than one agency, and doing so is often a smart strategy. A complaint filed with both the FTC and your state attorney general increases the chances that at least one agency will take action. Each agency has different enforcement tools, and the more records they have of a company's non-compliance, the stronger any eventual case will be.
The Easier Alternative: Automate Your Data Removal
Filing complaints is an important tool when brokers violate the law, but the best strategy is to prevent the problem in the first place. PrivacyOn automates data removal from 100+ data broker sites, continuously monitors for re-listings, and handles the entire opt-out process on your behalf. Instead of manually tracking down each broker and filing complaints when they do not cooperate, PrivacyOn keeps your information off these sites around the clock.
If a broker does ignore a legitimate removal request, the documentation PrivacyOn generates, including submission records and re-listing evidence, also gives you a stronger foundation for any formal complaint you choose to file.
Ready to take control of your personal data? Start with PrivacyOn and let automated removal work in the background while you focus on what matters.