Data Broker Legal Research: When There's No Opt-Out Page

Research for the Identity Defense Bench. Focus: what can a student actually DO when a data broker has no consumer opt-out?

For who owns, supplies and buys from these brokers, with every published link sourced to a regulator, court, SEC or federal procurement record, see the data broker dataset built for Reclaim City.

The Short Answer

"No opt-out page" does not mean "no legal obligation to delete your data." As of August 1, 2026, California's DELETE Act requires ALL registered data brokers to process deletion requests through the DROP platform — even if they've never had an opt-out page. Brokers that refuse face $200/day fines per request. The CPPA has a dedicated enforcement strike force hunting unregistered brokers.

For companies that are truly off the grid (no registration, no opt-out page, no response to letters), file a complaint with your state AG and the FTC. Both have active enforcement programs. There is no company in the US that is legally exempt from deletion requests under state privacy laws — some are just betting you won't bother.

1. Venntel / Babel Street

Status: FTC order in effect. No consumer opt-out, but data USE is now restricted.

The FTC took action against Gravy Analytics and its subsidiary Venntel for collecting, using, and selling sensitive geolocation data without user consent — including visits to healthcare facilities, places of worship, and military installations. Under the settlement:

• Prohibited from selling, disclosing, or using sensitive location data except in limited national security / law enforcement circumstances
• Required to establish a sensitive data location program with a list of sensitive locations to exclude
• Required to delete all previously collected location data and any products derived from it

Babel Street's Locate X product (which used Venntel data to track people visiting abortion clinics, mosques, etc.) is also the subject of a class-action investigation by The Lyon Firm.

What a student can do:

• The FTC order restricts the company, but there is no individual opt-out mechanism
• The real defense is on the phone side: deny location access to apps that don't need it (Settings → Privacy → Location Services). Venntel bought data from apps via SDKs — if the app can't collect your location, Venntel can't buy it
• File a CCPA/DROP deletion request — Gravy Analytics is registered as a California data broker

Sources:

• FTC Takes Action Against Data Brokers for Selling Sensitive Location Data
• FTC targets Gravy, Venntel, Mobilewalla
• Locate X Class Action Investigation

2. Exactis

Status: Functionally dead. Lawsuit stalled. No opt-out.

Exactis exposed 340M records on a publicly accessible server in June 2018. A class-action lawsuit was filed by Morgan & Morgan, but:

• The company has essentially no money
• It's unclear whether any unauthorized party ever accessed the data (vs. the researcher who found it)
• No settlement has been reached
• The company is functionally defunct

What a student can do:

• There is no company left to send a deletion request to
• The data is out there — the defense is monitoring: credit freezes, identity theft alerts, and checking HaveIBeenPwned
• File a CCPA/DROP request targeting any broker that may have purchased Exactis data downstream (the supply chain)

3. The Legal Landscape (2026)

States That REQUIRE Data Brokers to Honor Deletion Requests

Key: Even if a data broker has no opt-out web form, they are legally required to process a deletion request delivered by mail, email, or through DROP. Having no web form is not a legal exemption — it's a bet that you won't send a letter.

California DELETE Act (SB 362) — The Big One

• Covers ALL data brokers that meet the statutory definition, not just voluntarily registered ones
• DROP (Delete Request and Opt-out Platform) launched January 2026 for consumer signups
• August 1, 2026: Data brokers MUST check DROP every 45 days and process all deletion requests within 45 days
• Unverifiable requests still function as opt-outs of sale/sharing (even if they can't verify identity for full deletion)
• $200/day fine per unfulfilled deletion request
• Independent audit every 3 years beginning January 2028
• CPPA Data Broker Enforcement Strike Force created November 2025 — actively hunting unregistered brokers, 9 enforcement actions so far, $200/day penalties for non-registration ($54,600+ per unregistered broker and counting)

FTC Enforcement Actions

Senate Report: "Opt-Out Obstacles" (February 2026)

Senator Hassan's report found that data brokers were deliberately hiding their opt-out pages from Google by adding noindex tags — making opt-out pages technically exist while being impossible to find via search.

After the Senate inquiry, 4 of 5 investigated companies (Comscore, IQVIA, Telesign, 6sense) removed the noindex code and made opt-outs findable. Findem refused to respond to the Senate at all.

The report estimated data broker breaches have cost American consumers more than $20 billion.

Class Actions That Forced Change

4. What a Student Can Actually DO Today

When There IS an Opt-Out Page

Use it. Check back every 3-6 months — brokers re-add you from public records.

When There IS NO Opt-Out Page

Step 1: California DROP (free, one request covers 600+ brokers) → privacy.ca.gov/drop/ Sign up (requires CA residency verification). One submission goes to ALL registered brokers. They must process it by August 2026 deadline and every 45 days after.

Step 2: Formal deletion request letter (for any company, any state) → datarequests.org/generator/ Generates a ready-to-send deletion letter citing the applicable law (CCPA, GDPR, state privacy act). Send via email AND certified mail. They have 45 days to respond.

Your letter should include:

• Your name and enough identifying info for them to find your record
• "I am exercising my right to deletion under [CCPA/CPRA/VCDPA/CPA/GDPR Article 17]"
• "Please confirm deletion within 45 days as required by law"
• "If you cannot verify my identity, please process this as an opt-out of sale/sharing per Cal. Civ. Code § 1798.105(c)"

Step 3: File complaints when they ignore you

• California AG: oag.ca.gov/contact/consumer-complaint-against-business-or-company
• FTC: reportfraud.ftc.gov
• Your state AG: search "[your state] attorney general consumer complaint"
• CPPA (California-specific): cppa.ca.gov/complaints/

Step 4: Global Privacy Control (free, automatic) → Install a browser with GPC enabled (Firefox, Brave, DuckDuckGo) or the GPC extension Under California law, businesses MUST treat the GPC signal as a valid opt-out of sale/sharing. It runs automatically on every site you visit.

Step 5: For location data specifically — the phone is the source No deletion request can un-collect data that's already been sold downstream. The defense is cutting off the supply:

• iOS: Settings → Privacy & Security → Location Services → review every app → set most to "While Using" or "Never"
• Android: Settings → Location → App location permissions → same review
• Deny location to apps that have no reason to know where you are (calculators, flashlights, games, social media)
• Disable the advertising ID: iOS (Settings → Privacy → Tracking → off), Android (Settings → Privacy → Ads → Delete advertising ID)

When the Company Is Defunct (Exactis, etc.)

• The data is already in the supply chain — deletion requests go to the downstream buyers
• Monitor via credit freezes, HaveIBeenPwned, and identity theft alerts
• The FTC and state AGs can pursue successor companies that acquired the data

5. Companies Forced to Add Opt-Outs by Legal Action

The pattern: When there's no opt-out page, the fix comes from regulators and lawsuits, not individual requests. But individual requests CREATE the paper trail that regulators use to build enforcement cases. Your deletion letter that gets ignored becomes evidence in the AG's next enforcement action.