The United States has no comprehensive federal data privacy law. Unlike the European Union, which gives every citizen the right to demand deletion of their personal data under GDPR, Americans must rely on a patchwork of state laws that vary dramatically in scope and enforcement.
What that means in practice: your ability to legally demand that a data broker removes your information depends almost entirely on which state you live in. A California resident can cite the CCPA and a broker is legally obligated to comply. A resident of Alabama has no equivalent law and no legal leverage.
This guide breaks down the current privacy landscape across the US, explains what rights you actually have, and tells you what to realistically expect when you submit a removal request.
Why there is no federal law
Congress has debated federal privacy legislation for years without passing anything comprehensive. The result is a system where consumer privacy protections are determined at the state level, meaning the same data broker can be legally required to honor a deletion request from a Californian while being completely free to ignore an identical request from someone in Georgia.
The Federal Trade Commission has some authority to act against deceptive data practices, and specific sector laws like HIPAA (healthcare) and FERPA (education records) provide targeted protections. But for the broad category of personal data sold by commercial data brokers, there is no nationwide floor.
The CCPA: the gold standard
California's Consumer Privacy Act, passed in 2018 and expanded by the CPRA in 2020, is the most powerful consumer privacy law in the United States. It gives California residents the right to know what data a business holds about them, the right to request deletion, the right to opt out of the sale of their data, and the right to non-discrimination for exercising these rights.
Critically, the CCPA applies to businesses that meet a certain size threshold: annual gross revenue over $25 million, data on 100,000 or more consumers, or at least 50% of annual revenue from selling personal data. This captures most major data brokers but excludes smaller operators.
California also passed a first-in-the-nation Data Broker Registry law requiring data brokers to register with the state and honor deletion requests submitted through a centralized portal. This is the strongest broker-specific protection anywhere in the country.
Privacy protections by state
The following breakdown groups states by the strength of their current privacy protections. Note that this landscape is changing rapidly, with new laws passing and taking effect each year.
These states have comprehensive privacy laws that specifically address data brokers and give residents the right to demand deletion. California's CCPA is the most powerful consumer privacy law in the country and is frequently cited even by residents of other states.
These states have passed comprehensive privacy legislation giving residents meaningful rights including access, correction, deletion, and opt-out from data sales. Enforcement varies, but the legal framework is in place.
These states have partial protections in place, such as laws covering specific types of data (biometric data in Illinois, for example) or sector-specific rules. Residents have some leverage but not comprehensive deletion rights.
These states have little to no consumer privacy legislation. Residents have no legal right to demand deletion from data brokers. Removal depends entirely on each broker's voluntary opt-out process.
What about Florida?
Florida passed the Florida Digital Bill of Rights in 2023, but it includes a threshold that excludes most data brokers: it only applies to companies with $1 billion or more in annual global revenue. The vast majority of data brokers and people-search sites fall well below that threshold. For most Florida residents, there is currently no state law that meaningfully compels a broker to honor a deletion request.
This does not mean removal is impossible in Florida. Most major brokers offer voluntary opt-out forms regardless of the requester's state, because processing opt-out requests is cheaper than managing legal risk on a case-by-case basis. Practical removal rates for Florida residents are lower than for California residents, but removal is still achievable through the voluntary process.
Can you cite the CCPA if you do not live in California?
No. The CCPA is California law and applies only to California residents. Citing it from another state carries no legal weight. Some services that claim to submit CCPA-based removal requests on behalf of all users regardless of state are being misleading about the legal standing of those requests.
Your practical rights in any state
Regardless of where you live, you have a practical path to removal through each broker's voluntary opt-out process. Most major brokers maintain these forms because:
- •Compliance is cheaper than case-by-case legal disputes
- •Brokers operating nationally want to stay ahead of expanding state laws
- •Some brokers have committed to honoring removal requests from all US residents as a business practice
The practical difference between high-protection and low-protection states is not whether removal is possible, but whether a broker is legally required to comply. In strong-protection states, a broker that ignores a deletion request can face regulatory action. In minimal-protection states, the worst that happens to a non-complying broker is nothing.
What is the best approach given all of this?
Submit your own opt-out requests directly. Research shows that users who submit their own removal requests achieve a 70% removal rate, compared to 27% for fully automated services. The reason is straightforward: brokers respond better to direct, individual requests than to bulk automated submissions, which many have learned to deprioritize.
Know what your state gives you. If you live in California, Virginia, Colorado, or another strong-protection state, you have legal leverage. Cite your state law in your request where the opt-out form allows it. If you live in a minimal-protection state, use the voluntary opt-out forms and set realistic expectations.
Do it regularly. Your data will reappear. The removal process is not a one-time task but an ongoing practice. Setting a reminder to review your broker list every six to twelve months is the most practical long-term strategy.
A note on the changing landscape
Privacy law in the United States is moving quickly. Several states have passed laws in the last two years that have not yet taken full effect. The protections available to you today may be significantly stronger in twelve months. Saxalit updates state rights guidance as new laws come into effect.