Skip to content

Demo site. Fictional data; nothing is sent to anyone. Open the guided demo

UltoPulto
Try the scan

Data brokers and people-search sites

Short answer

Data brokers collect and sell personal information about people they have no direct relationship with. People-search sites are the most visible kind: they compile addresses, phone numbers, relatives and public records into reports that anyone can buy. Most offer a free opt-out, and laws in California, the EU and the UK may give you a right to deletion. Listings can come back, so a removal needs re-checking.

Published
Last reviewed

General information, not legal advice. This page has not yet been reviewed by a lawyer; check the linked primary sources before relying on it.

Key takeaways

  • People-search sites build reports from other brokers, public social media profiles and government records.
  • Most sites have a free opt-out that you can use yourself.
  • California residents can send one deletion request to the state's registered data brokers through the free DROP platform.
  • A listing can reappear when records change, so check again after a removal.

What is the problem?

The US Federal Trade Commission (FTC) describes people-search sites as businesses that collect personal information from a variety of sources, compile it into a report and sell that report to anyone willing to pay. A report can show your age, current and previous addresses, employment history, court records, and the names and addresses of family members.

Compiled on one page, these facts let a stranger work out where you live and who you are related to.

How does it happen?

According to the FTC, people-search sites buy information from other data brokers, read public social media profiles and compile government records such as property, voter registration and court records. California's regulator defines a data broker as a business that knowingly collects and sells the personal information of consumers it has no direct relationship with.

Removal is not always permanent. The FTC notes that if the information in your public records changes, your details could reappear for sale.

What laws may apply?

  • California, CCPA. Residents may ask a business to delete personal information and to stop selling or sharing it. Businesses must respond within 45 calendar days, extendable to 90. You may authorize another person to submit a request for you. Information from government records is not covered.
  • California, Delete Act. Data brokers must register every year with the California Privacy Protection Agency. Since 1 January 2026, residents can use the free Delete Request and Opt-out Platform (DROP) to send one request to more than 600 registered brokers. Since 1 August 2026, brokers must check DROP at least every 45 days and process requests. A status update can take up to 90 days.
  • EU and UK. Article 17 of the GDPR gives a right to have personal data deleted in defined cases, with exceptions such as freedom of expression and legal claims. The UK has the same right. Organisations have one month to respond and may take up to two more in some circumstances.
  • Elsewhere. Rights depend on where you live. Where no law applies, a site's opt-out is voluntary.

What you can do yourself

These steps are free and do not need UltoPulto.

  1. Search your full name with your city and note which people-search sites list you. Save the address of each listing.
  2. Use each site's own opt-out page. The FTC says most people-search sites have one and that you can opt out yourself for free.
  3. If you live in California, file a free request at privacy.ca.gov/drop.
  4. If you live in the EU or UK, send a written deletion request. The UK regulator says no specific words are required.
  5. Keep the date, the page and any reply for each request, and check the same sites again every few months.

What UltoPulto can do

  • The Exposure Scan checks people-search sites and shows what was found.Built
  • Removal and suppression requests to people-search sites and data brokers, written for the law that applies where you live.Built
  • Real delivery of requests. A request is sent only to a contact our team has verified; until then it stays a draft.In rollout
  • Opt-out form filling for sites that allow it. We never bypass CAPTCHAs.In rollout
  • An evidence trail on every case: the request, recipient, legal basis, replies, deadline and status history.Built
  • A follow-up after the legal deadline, then a regulator complaint draft for you to review and sign.Built
  • Re-checks to confirm removal and to catch a listing that has reappeared.Built
  • Guided filing on California's DROP platform.Planned

What UltoPulto cannot do

  • Guarantee that a broker complies, or how quickly. A request can be refused, and we show it as refused.
  • Change the public records, such as property or court records, that brokers copy from.
  • Stop a listing from coming back. We can catch it when it has reappeared and request removal again.
  • Affect AI systems through a broker removal. No service can remove a person from an AI model that has already been trained.

Sources

  1. 1What To Know About People Search Sites That Sell Your InformationFederal Trade CommissionGovernmentOpened 2026-10-04
  2. 2Delete Request and Opt-out Platform (DROP)State of CaliforniaGovernmentOpened 2026-10-04
  3. 3Information for Data BrokersCalifornia Privacy Protection AgencyGovernmentOpened 2026-10-04
  4. 4California Consumer Privacy Act (CCPA)California Office of the Attorney GeneralGovernmentOpened 2026-10-04
  5. 5Art. 17 GDPR: Right to erasure ('right to be forgotten')GDPR text, gdpr-info.euLawOpened 2026-10-04
  6. 6Art. 12 GDPR: Transparent information, communication and modalities for the exercise of the rights of the data subjectGDPR text, gdpr-info.euLawOpened 2026-10-04
  7. 7Your right to get your data deletedInformation Commissioner's Office (UK)GovernmentOpened 2026-10-04

Questions

Why am I listed on a site I never signed up for?

People-search sites do not need an account from you. The FTC explains that they buy data from other brokers and compile public social media profiles and government records.

Do I have to pay to opt out?

No. The FTC says you can opt out of people-search sites yourself for free.

How long does a removal take?

It depends on the law. Under the CCPA a business has 45 calendar days, extendable to 90. Under the GDPR an organisation has one month, extendable by two.

Will my information come back after it is removed?

It can. The FTC notes that when your public records change, your information could reappear for sale, which is why re-checking matters.