Your rights and how to opt out

The rights available to you depend heavily on where you live. This lesson covers four concrete, official routes: the EU’s GDPR access and erasure rights, France’s CNIL guidance on exercising them, California’s new Delete Request and Opt-out Platform, and the more limited, sector-specific approach in US federal law.

The EU: access and erasure under the GDPR

The European Commission’s official citizen guidance summarises two rights that apply to any organisation processing your personal data in the EU, including data brokers. First, the right of access: you can “request access to the personal data a company or organisation has about you” and are entitled to “a copy of your data, free of charge, in an accessible format”, with a reply required within one month. Second, the right to erasure, often called the right to be forgotten: “if your personal data is no longer needed or is being unlawful then you can ask for your data to be erased”, a right that extends to asking search engines to delist pages about you under certain conditions. The guidance is honest about a real limit: some data may not be erased where doing so would conflict with other rights, such as freedom of expression, or a genuine public interest in information about a public figure.

France’s data protection authority, the CNIL, describes the same family of rights in practice: the right of access, the right to have incorrect data corrected, the right to object to processing, and the right to erasure. Its guidance is direct about how to start: contact the organisation holding your data yourself; if it does not respond adequately, you can bring the matter to the CNIL, which can investigate and, if warranted, sanction the organisation. In practice, exercising this against a data broker usually means identifying which broker holds your data and sending a written request, since no single portal covers every company at once.

California: a single request to hundreds of brokers at once

California has built something the EU has not: a state-run tool aimed specifically at data brokers. The California Privacy Protection Agency’s Delete Request and Opt-out Platform, DROP, lets a California resident “send one request to over 600 registered data brokers” asking them to delete the personal information they hold and stop selling it, without having to contact each broker individually. Under the agency’s published timeline, the platform launched on 1 January 2026, brokers began processing requests from 1 August 2026, and by November 2026 all registered brokers must have completed their first cycle and be deleting matched data on a recurring basis — the agency states data must be deleted every 45 days. Verification runs through California’s Identity Gateway, and the agency notes that “you do not need to create a California Identity Gateway account, and your information is not retained by DROP.” This is a California-resident tool: it does not reach brokers who never registered with the state, and it does not extend rights to people outside California.

The United States federally: narrower, and mostly manual

The US has no single federal law giving a general right to access or delete data held by any broker, the way the GDPR does. The FTC’s consumer guidance on people search sites — a visible category of broker — is candid about what this means in practice: you can generally “do it on your own, one by one, for free, or pay a service to opt out for you”, searching for your name on each site and following that site’s own removal process. The same guidance warns that even a successful opt-out “might not fix all your privacy concerns”, since your information can still appear in reports built around your relatives. Separately, the FTC does offer a genuinely useful narrower tool: its guidance on stopping unwanted mail explains that consumers can opt out of prescreened credit and insurance offers, built from lists supplied by the major credit bureaus, for five years or permanently through the dedicated optoutprescreen.com service — though it also notes plainly that this “will not stop all unsolicited offers”, since other lists exist outside that system.