How long does data broker removal take?

The legal clock is 45 days in California and one month in the EU. A California business must respond to a deletion request within 45 calendar days, or 90 if it tells you it needs longer. California also runs a statewide system called DROP. A data broker must check it for your request at least every 45 days, then report what it did within 45 days. So the state says to allow up to 90 days. Removal services say a site can take anything from a day to six weeks. And one removal is rarely the end, because brokers keep collecting new copies.

What a data broker is

A data broker is a business that collects and sells information about people it has no direct relationship with. That is close to the definition California uses. You never signed up with it. It got your details from somewhere else.

The ones most people notice are people search sites. Type in a name and they show an address, a phone number, an age and a list of relatives. California's privacy agency says they trade email addresses, phone numbers, precise location, shopping habits and the browsing history that web tracking collects. They also sell guesses about your health, money and politics, to buyers that include marketers, employers, landlords and debt collectors.

For timing, one fact matters most. A broker keeps refilling its database, and that explains most of what follows. It is also a different problem from a data breach, where data escapes by accident. A broker sells it on purpose.

The legal clocks

Three rules set a deadline, and each one ends with something different.

The CCPA. The California Consumer Privacy Act lets residents ask a business to delete what it holds. The state attorney general's guidance is plain: businesses must respond within 45 calendar days and can extend by another 45 if they notify you. The deadline is for a response, and a response can be no.

DROP. The Delete Request and Opt-out Platform comes from California's Delete Act. You confirm that you live in California and enter details such as your name, date of birth, email and phone number. One request then goes to more than 600 registered brokers. Demand came early: by July 15, 2026, before any broker had to act, the agency counted more than 345,000 requests. Each broker must log in at least once every 45 days to pick up new requests. A change in the law, AB 883, cuts that to every 30 days from January 1, 2027. Within 45 days of receiving a request, the broker must report one of four results: deleted, exempted, opted out or record not found.

The GDPR. In the EU, Article 12 of the General Data Protection Regulation says a company must tell you what it did without undue delay and within one month. If it needs two more months, it must say so, and why, within the first month. Acting on the request is free, unless it is plainly unfounded or excessive.

One request walked through the dates

Suppose you live in California and a people search site shows your home address. You try both legal routes on October 1, 2026.

• A direct CCPA request. You email the site asking it to delete your record. Its 45 days end on November 15. If it gives notice that it needs longer, the outer limit is December 30.
• A DROP request. If the site is a registered broker, it must log in at least every 45 days, so it picks up your request by November 15 at the latest. It then has 45 days to report a status, again by December 30.
• After that. The broker must keep deleting new matching data at least every 45 days, and every 30 days from January 2027.

Both routes give the same outer date, about 90 days. Neither promises the page is gone from search results by then. As DuckDuckGo's removal pages point out, a search engine can keep showing an old result until it crawls the updated site again.

What brokers and removal services say

Removal services send opt out requests to brokers for a subscription fee. Read their timings as the companies' own claims about their own work.

So which is right, "a few days" or "45 days"? Both, because they measure different things. The services describe what usually happens at the sites they work with. The law sets the latest a business may take to respond. A slow site is not breaking the law until its 45 days run out.

The services also explain why some sites are slower. DeleteMe names email or ID checks, which can add days, and sites that review opt outs by hand or in weekly or monthly batches. And Offlist's figures show how much the paperwork varies: one broker takes an email, another wants a letter and a copy of your ID.

Why listings come back

You delete a listing, and months later it is back. The three services explain it in much the same way.

• New data keeps arriving. DeleteMe says new data from public records and everyday sign ups can repopulate brokers after a removal. DuckDuckGo says details reappear when collected from new sources.
• Some brokers re-list. Incogni says many brokers regularly re-list information that was already removed.
• Public records are exempt. A business can refuse to delete publicly available information, such as an address in property records, the attorney general notes. DROP marks these as exempted, along with data covered by laws such as HIPAA and the Fair Credit Reporting Act.
• No exact match. If a broker cannot tie your details to one person, DROP shows opted out. The broker keeps the data but can no longer sell or share it.
• What you gave directly. DROP covers only data a broker got from other sources. Data you gave it yourself, say by buying from it, needs a separate deletion request.

This is why DROP is built as a cycle. The state calls it ongoing, not a one time action. A broker that buys a fresh copy of your address next spring has to match it against your request and delete it at the next check. A single opt out, sent by you or by a service, covers only the copy that existed that day.

The same pattern explains why a deleted social media account takes up to 90 days to disappear. The visible copy goes first. The others go later, or not at all.

What these clocks do not cover

DROP and the CCPA protect California residents only. Elsewhere in the US, your own state's law, if it has one, and each broker's policy decide. The common pattern in state laws is in what you can ask a company to do with your data. DROP reaches registered data brokers only. It does not cover the search engine that shows a broker's page, or the news sites, social media and government records that hold your name. And a deadline met is not a record deleted: a lawful answer can be an exemption, or a request for proof of who you are. These figures are as published in November 2026. This is general information, not legal advice.

If someone is targeting you, a deletion request will not keep you safe on its own. The steps for responding to online harassment start with account security and evidence, not opt outs.

What to do next

1. Make a list first. Search your name, city and phone number, and save the address of each page that shows you. As Offlist puts it, a request is not evidence of removal.
2. Use DROP if you live in California. Add your maiden name and every email and phone number you use, since more data means more matches. Save your 8 digit DROP ID.
3. Send direct requests for the worst listings. Put the 45 day mark in your calendar.
4. Answer verification emails quickly. DeleteMe names them as a common cause of delay.
5. Check again after each cycle. Search your name about every 45 days, and add any new pages to your list.
6. Close the leaks you control. Brokers often collect data from businesses you deal with, so delete old accounts properly. If a listing showed your full date of birth or old addresses, watch for the early signs of identity theft.