Twenty US states have comprehensive privacy laws in effect in 2026, giving residents the right to access, delete, and opt out of the sale of their personal data. California's DROP portal — live since January 1 and fully operational for deletion on August 1, 2026 — is the strongest data broker deletion right in the country. Connecticut, Texas, Oregon, and Vermont also have data broker registries. Here is what each state gives you and how to use it.
The 20 States With Comprehensive Privacy Laws (2026)
As of August 2026, the following states have enforceable, comprehensive consumer privacy laws:
- California (CCPA/CPRA + Delete Act)
- Virginia (VCDPA)
- Colorado (CPA)
- Connecticut (CTDPA + Data Broker Law)
- Utah (UCPA)
- Iowa (ICDPA)
- Indiana (ICDPA) — effective January 1, 2026
- Kentucky (KCDPA) — effective January 1, 2026
- Rhode Island (RIDTPPA) — effective January 1, 2026
- Tennessee (TIPA)
- Montana (MCDPA)
- Oregon (OCPA + Data Broker Registry)
- Texas (TDPSA + Data Broker Registry)
- Delaware (DPDPA)
- New Jersey (NJDPA)
- New Hampshire (NHDPA)
- Maryland (MODPA)
- Minnesota (MCDPA)
- Nebraska (NDPA)
- Vermont (Data Broker Regulation)
Amendments and enforcement changes continue to roll out through 2026 in Colorado, Connecticut, Oregon, Montana, and others, generally tightening broker obligations rather than loosening them.
Which States Have Data Broker Deletion Rights in 2026?
Not every state privacy law creates a right to delete your data from data brokers specifically. Broker-focused deletion rights come from two mechanisms: (1) comprehensive state privacy laws that include deletion rights broker-inclusive, and (2) dedicated data broker laws.
The Four States With Dedicated Data Broker Laws
California (Delete Act + DROP portal), Vermont (broker registration), Oregon (broker registry as of 2024), and Texas (broker registry) all maintain public registries of data brokers doing business in the state. California is the only one with a live centralized deletion tool.
California: The Strongest Data Broker Rights in the Country
California's Delete Act (Senate Bill 362) launched the Delete Request and Opt-Out Platform (DROP) on January 1, 2026 — the first-of-its-kind government tool that lets California residents submit a single deletion request to every registered data broker in the state. Starting August 1, 2026, registered brokers must access the DROP platform every 45 days and delete matching consumer files. Non-compliance carries penalties of $200/day, and the CPPA has a dedicated Data Broker Enforcement Strike Force.
See our full DROP explainer. Californians should use DROP as a free baseline, then supplement with a nationwide removal service to cover brokers outside the state registry.
Connecticut: Next After California
Connecticut passed its own data broker law that requires broker registration, prohibits the sale of certain sensitive data, and mandates that brokers honor consumer deletion requests. By July 1, 2028, Connecticut will operate its own centralized deletion mechanism modeled on California's DROP. Until then, Connecticut residents rely on the CTDPA's individual deletion right, submitted broker-by-broker.
Oregon and Texas: Registries, Not Portals
Oregon has required data brokers to register since January 1, 2024, and its 2025 amendments align broker obligations with the OCPA. Texas's data broker registration law took effect in 2024 alongside the TDPSA. Both states publish public registries you can search to find every broker operating in your state, but neither has a centralized deletion portal — deletion still happens broker-by-broker.
Skip the manual work
PrivacyOn removes your personal information from 100+ data broker sites and keeps it removed — automatically.
Start your free scan★★★★★ 4.8/5 · Trusted by thousands of families
Vermont: The Original Data Broker Registry
Vermont has required data broker registration since 2019, making it the earliest state to formally track the industry. Vermont's law does not include a comprehensive consumer privacy statute, so deletion rights are narrower than in the states above, but the registry itself is a powerful transparency tool.
The 15+ States With General Privacy Rights but No Broker Registry
Every state with a comprehensive privacy law gives residents these core rights, exercisable directly against any business (data broker or otherwise) that collects their data:
- Right to access: Know what personal information a business has collected about you.
- Right to delete: Ask the business to delete your information (with exceptions for legal compliance and business necessity).
- Right to correct: Fix inaccurate information (available in most, but not all, state laws).
- Right to opt out: Refuse the sale or sharing of your personal data for targeted advertising or profiling.
- Right to data portability: Receive a copy of your data in a portable, machine-readable format.
- Right to appeal: Contest a business's denial of a rights request.
The catch: without a centralized portal, you must submit each request to each broker individually, which is exactly the problem PrivacyOn automates.
Global Privacy Control
California, Colorado, Connecticut, Delaware, Nebraska, New Hampshire, New Jersey, Oregon, and Texas require businesses to honor a browser-level opt-out signal called Global Privacy Control (GPC). Enable it in Firefox or Brave (built-in), or via an extension in Chrome, and covered businesses in those states must treat every page load as an opt-out of sale/sharing — a free, always-on layer on top of every rights request you file.
What About Federal Privacy Law?
Congress continues to debate comprehensive federal privacy legislation, but no federal law has passed as of August 2026. Sectoral federal laws (HIPAA for health, GLBA for finance, COPPA for children under 13, FCRA for consumer reporting) still apply, but they do not create a general consumer right to delete data broker profiles.
How to Use Your State Privacy Rights in Practice
- Confirm your state's law. Find your state in the list above and read our state-by-state privacy law guides.
- Use the centralized tool if available. Californians should start with DROP. Everyone else should identify the data brokers holding their information first.
- Submit deletion requests. Send a request under your state law to each broker holding your data. Our deletion request template is state-agnostic and includes the required legal citations.
- Track the response window. Most state laws give businesses 45 days to respond, extendable once by another 45.
- Appeal denials. If a broker refuses, use the state's appeal right (usually within 60 days).
- Monitor for re-listing. State laws do not prevent brokers from re-adding your data from new public records. Ongoing monitoring is the only real fix.
Where PrivacyOn Fits In
Even in the strongest privacy states, exercising your rights across 100+ data brokers manually is a full-time job. PrivacyOn submits removal requests under whichever state law applies to you, tracks responses, appeals denials, and monitors 24/7 for re-listings — nationwide. It works alongside California's DROP and every other state privacy law, doing the broker-by-broker legwork the laws themselves do not automate. Plans start at $8.33/month with family coverage for up to 5 people.
Frequently Asked Questions
Which US states have data broker deletion rights in 2026?
All 20 states with comprehensive privacy laws grant residents the right to delete personal data held by any business including data brokers. California, Vermont, Oregon, Texas, and Connecticut also maintain dedicated data broker registries, with California operating the only live centralized deletion portal (DROP). Connecticut's own centralized deletion mechanism launches by July 1, 2028.
What is the California DROP portal and who can use it?
DROP (Delete Request and Opt-Out Platform) is a free California Privacy Protection Agency tool that lets California residents submit one deletion request that is sent to every registered data broker in the state. It went live January 1, 2026, and brokers must begin processing DROP deletions every 45 days starting August 1, 2026. Only California residents qualify.
Do I have data broker deletion rights if I do not live in a state with a privacy law?
Not under state law, no. If you live in a state without a comprehensive privacy law, you must rely on each individual broker's voluntary opt-out mechanism or the sectoral federal laws (like FCRA for consumer reporting). A service like PrivacyOn opts you out regardless of state, because it uses each broker's own opt-out flow rather than relying on legal citations.
Which state has the strongest privacy law in 2026?
California, by a wide margin. The CCPA/CPRA combined with the Delete Act and the live DROP portal give Californians the most comprehensive and easiest-to-use data broker deletion rights in the country. Colorado, Connecticut, and Oregon are close behind on general privacy rights but lack a live centralized deletion tool.
What are the new state privacy laws effective in 2026?
Indiana, Kentucky, and Rhode Island all had comprehensive privacy laws take effect on January 1, 2026. Connecticut, Arkansas, and Utah had important amendments take effect July 1, 2026. California's new data broker registration requirements took effect August 1, 2026.
How long do businesses have to respond to a state privacy request?
Most state privacy laws give businesses 45 days to respond to a rights request, extendable once by another 45 days if they notify you of the extension. California and a few others allow further extension in complex cases. If a business does not respond, file a complaint with the state attorney general or the California Privacy Protection Agency.
How do I use my state privacy rights without doing it manually for every broker?
PrivacyOn submits state-law deletion requests to 100+ data brokers on your behalf, tracks their responses, and monitors 24/7 for re-listings — whether you live in California, Oregon, Kentucky, or a state with no privacy law at all. It complements every state law by automating the broker-by-broker legwork, starting at $8.33/month with family plans for up to 5 people.