Data Broker Response Report
What happens after you ask a data broker to delete your data. Aggregate results from 621 authorized-agent requests PrivacyOn sent to 75 brokers between 2026-08-21 and 2026-10-12. Recomputed daily — last updated 2026-10-12. No broker is named; free to cite with a link.
22%
of requests have received any reply
138 of 621
22%
replied within 72 hours
89 of 408 requests at least 72h old
59%
still unanswered after 14 days
26 of 44 requests at least 14 days old
47%
of first replies are only an auto-acknowledgement
65 of 138
42 hours
median time from request to confirmed removal
n = 14, small sample
36%
of our people-search scans blocked by anti-bot measures
20,017 scans, last 30 days
19%
of steps that require the person themselves have been completed
70 of 362
How quickly brokers respond
Each request is an email sent on a customer's behalf under CCPA/CPRA (US) or GDPR/UK GDPR, with a statutory deadline of 45 days (US) or one month (EU/UK). A "reply" is any message from the broker about that request, including an automatic acknowledgement. Timing shares only count requests that are old enough to have been answered in that window.
Deadlines reached so far: 3; of those, 0 had a reply by the deadline — small sample (n = 3). Most requests in this sample are recent, so "before the deadline" currently means "has replied at all" — the figure will become meaningful as deadlines pass.
What brokers say when they reply
Among the 138 requests that received a reply, the strongest outcome seen so far. A request that was only acknowledged and has had no substantive answer since is counted as "acknowledgement only".
Redirects to a web form are notable: those forms typically require the individual to complete them personally, which is how an authorized-agent request becomes a self-serve task.
Time to confirmed removal
For the 14 requests where the broker confirmed deletion, the median time from our request to that confirmation is 42 hours; the 75th percentile is 12.1 days. This is a small sample and skews toward brokers that answer quickly; requests still open will push these figures up.
Blocking the people who check
Over the last 30 days, 36% of PrivacyOn's automated people-search scans (7,226 of 20,017) were blocked by anti-bot measures — CAPTCHAs, rate limits, or IP bans — before a result could be read. The sites that publish personal data to anyone who searches routinely stop automated checks on whether it is still there.
Methodology
Source. PrivacyOn's own removal system: deletion requests we send as an authorized agent on behalf of paying customers, under CCPA/CPRA (California Civil Code § 1798.105, Cal. Code Regs. tit. 11 § 7021) for US residents and GDPR Article 17 / UK GDPR for EU and UK residents, plus the replies those requests receive and the results of our automated people-search scans.
Sample. 621 requests sent by email to 75 distinct brokers from 2026-08-21 to 2026-10-12. A request is in the sample if it was emailed and either remains an email request or received any matched reply — including replies telling us to use a web form instead, which our system otherwise reclassifies. Requests handled from the start through a broker's web form (which the individual must complete) are excluded from reply metrics and reported separately as "steps that require the person themselves".
Reply. Any inbound message from the broker matched to a request, excluding messages unrelated to the request and our own follow-ups. "Auto-acknowledgement" means the first reply was an automated receipt with no decision. Reply-timing shares use a matured denominator: a request counts toward "replied within 72 hours" only once it is at least 72 hours old, and likewise for 7 and 14 days.
Outcome. One outcome per replied request, the strongest seen: confirmed removed, no data held, rejected, redirected to a web form, identity verification requested from the person, proof of authorization requested from us, or acknowledgement only. "Time to confirmed removal" is measured from our request to the broker's confirmation, for requests whose status is confirmed removed.
Scanner block rate. Share of automated people-search scan runs in the last 30 days that ended in an anti-bot block rather than a readable result (a listing found, no listing, or a technical error).
Limitations. This is an early, growing dataset: most requests were sent in the last few weeks, few statutory deadlines have passed, and figures with fewer than 30 observations are marked as small samples. Our customers are a self-selected group of people who already found themselves on broker sites. Replies are classified automatically, with human review of edge cases. Counts recompute from the live database once a day; a snapshot is served if the database is unavailable.
Privacy. This report is aggregate only. No broker, company, or site is named, and no customer is identifiable. We will not provide per-broker breakdowns.
Cite this report
Free to cite under CC BY 4.0 — attribute "PrivacyOn Data Broker Response Report" with a link to the canonical URL. The embed and JSON refresh daily with the page.
Canonical URL
https://www.privacyon.com/data-broker-response-reportEmbed the headline chart
<a href="https://www.privacyon.com/data-broker-response-report"><img src="https://www.privacyon.com/api/embed/response-report" width="640" height="360" alt="PrivacyOn Data Broker Response Report" /></a>Raw numbers (JSON)
https://www.privacyon.com/api/embed/response-report?format=jsonQuestions about the data: support@privacyon.com.