Find Your Details on Data-Broker Sites and Get Them Removed: A Free-First Workflow

A breach exposes your details once. Data brokers are the market that keeps them circulating. If your name, address and phone number turn up in a breach notice, the practical question is how to find where they now appear and how to get them taken down without paying anyone. This is a free-first workflow, in the order we would run it. It is general information, not legal advice.

What counts as a data broker

California defines the category narrowly: a business that knowingly collects and sells "to third parties the personal information of a consumer with whom the business does not have a direct relationship." You never signed up with them, which is why you have to go and look.

Step 1: lock the money side first

Deleting a listing does nothing about a thief who already has your details, so freeze your credit before you start. The FTC says "There's no cost to place or lift a credit freeze, and it doesn't affect your credit score," and "Anyone can do it, any time." You contact all three bureaus: Equifax, Experian and TransUnion. A freeze lasts until you lift it, and while it is on "nobody can open a new credit account in your name, including you."

Step 2: find the listings

Finding the URLs is the real work, because every removal request needs one. Open a private browser window and search your full name in quotes with your city, then your home address, then your phone number and email address. Log every URL in a spreadsheet with the date and a screenshot. Repeat monthly.

Step 3: California residents, file a DROP request

California built one free form for this: the Delete Request and Opt-out Platform (DROP), run by the California Privacy Protection Agency. The agency's published timeline:

• January 1, 2026: DROP launches and residents can submit requests.
• August 1, 2026: data brokers begin processing requests.
• Brokers must delete data every 45 days.

It costs nothing, needs only your name, date of birth and ZIP code, and the agency says "The more information you enter, the more likely your data will be deleted." You get one of two outcomes. "Deleted" means the broker matched you and deleted non-exempt data. "Opted-out" means it could not make an exact match, so it "can no longer sell or share" your data but still holds it. A broker that fails to delete faces $200 per request per day, enforced by the agency.

Know what DROP does not touch, in the agency's words: "Data given directly to a business (first-party data)," exempted data, and publicly available data. It also says "Results vary by broker." It does not reach a forum post or paste site where breached records were dumped, or news coverage.

Step 4: outside California

DROP requires California residency. If you live elsewhere, removal runs broker by broker, with no single form. Use your URL log from step 2 and each broker's own opt-out page, and check your own state's broker rules, which this article does not cover.

Step 5: Google results

Google's "Results about you" tool monitors and requests removal of results showing your contact details. On February 10, 2026, Google said it can also find and request removal of results containing government-issued IDs such as a passport, driver's license or social security number, rolling out in the U.S. With notifications on you get one "within a few hours" when results match.

Its limits are worth knowing before you spend a week on it:

• It removes results, not the page. Google: "Even if Google removes something from Google Search, it might still be on the internet."
• A removed page "won't show up on Google search results for any search query that contains your name or identifier. But, it might show up if they search for something else."
• It will not remove pages owned by educational or government institutions or newspapers, and newsworthy content may stay.

Step 6: watch for impersonation

The FTC's consumer alert dated November 12, 2026 reports more than 1 million imposter scam reports last year, with reported losses of $3.5 billion. Agree one rule with your family and assistant: no payment or credential change on the strength of a message alone. A call to a number you already have confirms it.

Where this runs out

The free steps cover credit, California brokers and Google. Continuous monitoring, brokers outside California's mechanism with documented re-checks, and takedown escalation when Google is not enough are the continuous, adversarial part. We are DefendMyRep, a reputation and privacy defense firm, and our longer guide has every source: Your Driver's License and Home Address Were in a Data Breach. On where leaked records tend to surface first, see our note on dark forum monitoring. To see what is currently findable about you or your business, request a free reputation audit report.