The Gap Between Privacy Law and Privacy Reality

Every major privacy law in the United States sets a deadline for how quickly companies must respond to data deletion requests. California's CCPA gives brokers 45 business days. Virginia's VCDPA allows 45 calendar days. Colorado's CPA sets 45 days with a possible 45-day extension. On paper, these timelines sound reasonable. In practice, the story is far more complicated.

At GhostMyData, our removal pipeline processes deletion requests across 1,500+ data broker sites continuously. We track every request from submission to confirmation, measuring exactly how long each broker takes to acknowledge, process, and complete a removal. Over the past several months, we have aggregated and anonymized this data to answer a question our users ask constantly: how long does this actually take?

This analysis is based on our platform's operational data across all broker categories. The numbers represent real removal requests processed through our automated pipeline, not self-reported figures from brokers or theoretical estimates. Where we cite ranges, those reflect the middle 80% of observations to exclude outliers caused by temporary outages or holiday slowdowns.

Overall Response Time Distribution

Across all broker categories and all removal methods, the median time from request submission to confirmed data removal is approximately 12 days. That number, however, masks enormous variation depending on broker type, removal method, and time of year.

Here is how the distribution breaks down:

Under 24 hours: Approximately 8% of all requests. These are almost exclusively automated form-based opt-outs from people-search sites with real-time processing.
1 to 3 days: Roughly 22% of requests. This bucket includes the faster people-search sites and some marketing data brokers with streamlined processes.
4 to 14 days: The largest segment at about 35%. Most people-search sites with manual review queues and mid-tier marketing brokers land here.
15 to 30 days: Around 20% of requests. Enterprise data brokers, background check companies, and brokers with identity verification requirements.
31 to 45 days: About 10% of requests. These brokers are running the clock to the legal deadline, particularly CCPA-regulated enterprise brokers.
Over 45 days or no response: Roughly 5% of requests either exceed the legal deadline or produce no response at all.

People-Search Sites: The Fastest Category (Usually)

People-search sites — the Spokeos, BeenVerifieds, and Whitepages of the world — are generally the fastest to process removals. This makes sense: they are the most visible targets for privacy advocates, they face the most direct consumer complaints, and many of them have built automated opt-out systems to handle the volume.

Fastest people-search responders (typically under 48 hours):

Sites like TruePeopleSearch and FastPeopleSearch process many removals within 24 to 48 hours of submission. Their opt-out systems are relatively straightforward, and the processing appears to be at least semi-automated. The tradeoff is that these sites also have some of the highest re-listing rates, meaning your data may reappear within weeks or months as they re-ingest records from their upstream sources.

Mid-range people-search sites (3 to 10 days):

The majority of people-search sites fall into this range. Spokeo, WhitePages, Intelius, and similar platforms typically process removals within a week. Some require email verification before processing begins, which can add a day or two if the confirmation email lands in spam. BeenVerified advertises 24-hour processing, but we observe a median closer to 2 to 3 days for full removal across all their properties.

Slow people-search sites (10 to 30 days):

A smaller subset of people-search sites takes notably longer. Radaris, for example, has a complex opt-out process and regularly takes 10 to 20 days. MyLife has historically been among the slowest in this category, with some removals stretching past two weeks. Sites that require mailed identity verification (increasingly rare, but still encountered) can push into the 20 to 30 day range.

Enterprise Data Brokers: The 45-Day Clock

Enterprise data brokers — companies like Acxiom, Oracle Data Cloud, Epsilon, and LexisNexis — operate on an entirely different timeline. These are companies that sell data to other businesses rather than directly to consumers, and they tend to treat the CCPA 45-day window as a target rather than a ceiling.

Based on our CCPA right-to-know and deletion request pipeline, here is what we observe:

Average response time: 28 to 35 days for an initial acknowledgment, with full deletion confirmation often arriving at the 40 to 45 day mark.
Acknowledgment vs. completion: Most enterprise brokers will acknowledge receipt within 5 to 10 business days. The actual deletion, however, happens much later. Some brokers send a "we received your request" email quickly, then go silent until the deadline approaches.
Identity verification delays: Enterprise brokers are far more likely to request additional identity verification. LexisNexis, for instance, may ask for a government-issued ID and a utility bill. This back-and-forth can add 7 to 14 days to the process.
Partial compliance: Some enterprise brokers will delete certain categories of data while claiming other categories are exempt under legal exceptions (fraud prevention, contractual obligations, legal holds). This is technically allowed under CCPA, but it means "deletion" does not always mean what consumers expect.

Marketing and Advertising Brokers: The Middle Ground

Marketing-focused data brokers — companies that compile consumer profiles for targeted advertising — fall between people-search sites and enterprise brokers in response time. These include companies like LiveRamp, TransUnion's marketing division, and various ad-tech platforms.

Typical response time: 10 to 25 days.
Batch processing: Many marketing brokers process opt-out requests in batches rather than individually. We have observed patterns suggesting weekly or bi-weekly processing cycles, where requests submitted on Monday and requests submitted on Friday are both processed the following week.
Downstream propagation: Even after a marketing broker confirms deletion, their data may persist in downstream systems for weeks. If they sold your data to an advertiser before processing your request, that downstream copy is not affected by the original deletion.

Brokers That Ignore Requests Entirely

Perhaps the most frustrating finding is that a meaningful percentage of data brokers simply do not respond to removal requests. Based on our data:

Approximately 5% of all requests receive no response whatsoever within 60 days.
Another 3% receive an automated acknowledgment but no follow-through on the actual deletion.
Smaller, less-known brokers are significantly more likely to ignore requests than established players. The long tail of niche data aggregators and resellers has the worst compliance record.

When a broker ignores a request, there are limited enforcement options. California residents can file a complaint with the Attorney General's office. Residents of states with private right of action (currently only California under CCPA, with limited scope) can pursue legal action, though the economics rarely justify it for individual consumers.

Compliance Rates by Broker Category

We track not just response times but also completion rates — what percentage of requests result in confirmed data removal within the legal deadline.

Broker Category

Completion Rate Within Legal Deadline

Average Days to Completion

People-Search Sites	85-92%	5-10 days
Background Check Services	75-85%	14-25 days
Marketing/Advertising Brokers	70-80%	15-30 days
Enterprise Data Brokers (CCPA)	65-75%	30-45 days
Niche/Small Aggregators	50-65%	Highly variable

The people-search category leads in compliance because these sites face the most consumer scrutiny and have the simplest data models. Enterprise data brokers have lower completion rates partly because their data architectures are genuinely more complex, but also because enforcement pressure is lower when the consumer cannot easily see whether their data was actually deleted.

Seasonal and Temporal Patterns

Our data reveals several interesting temporal patterns in broker response times:

January slowdowns: Response times increase by 15 to 25% in January, likely due to holiday staffing and the influx of New Year privacy resolutions driving higher request volumes.

Quarter-end acceleration: We observe faster processing times in the final two weeks of each calendar quarter, particularly Q4. This may reflect internal compliance reviews and reporting cycles.

Post-breach surges: After a major data breach makes national news, response times across all broker categories tend to slow for 2 to 4 weeks. The spike in consumer requests overwhelms processing capacity, particularly at smaller brokers without automated systems.

Legislative deadline effects: When new state privacy laws take effect (several new laws took effect in 2025 and 2026), we see a brief period of faster responses from brokers operating in those states, followed by a return to baseline. The compliance effort appears front-loaded around the effective date.

What This Means for Individuals

If you are submitting removal requests manually, here is what our data suggests you should expect:

Budget at least 45 days per request: Even if many will resolve faster, setting expectations at the legal maximum prevents frustration.
Follow up at the 30-day mark: A polite follow-up email citing the applicable state law and its deadline tends to accelerate responses that have stalled.
Document everything: Keep records of when you submitted each request, what method you used, and any confirmation numbers. This documentation is essential if you need to file a complaint or escalate.
Prioritize high-visibility sites first: People-search sites are faster to respond and represent the most immediately visible exposure. Start there, then work through enterprise brokers.
Plan for re-listing: Even after successful removal, many brokers will re-list you within 3 to 6 months. Ongoing monitoring is not optional; it is a requirement for sustained privacy.

Why Automated Removal Services Exist

The math on manual removal is not encouraging. If you have data on 50 brokers (a conservative estimate for most Americans), and each removal takes an average of 20 minutes to research, submit, verify, and confirm — plus follow-up time for non-responsive brokers — you are looking at 20+ hours of work for the initial round alone. Factor in re-listing and re-monitoring, and manual removal becomes a part-time job.

This is precisely why automated removal services exist. Our pipeline at GhostMyData handles the submission, tracking, follow-up, and re-monitoring automatically across 1,500+ broker sites. We escalate non-responsive brokers, adapt to changing opt-out processes, and re-scan for re-listings on a recurring schedule. The data in this report comes directly from that pipeline.

Automate Your Privacy with GhostMyData

Stop spending hours submitting individual removal requests and waiting weeks for responses. GhostMyData automates the entire removal lifecycle:

Automated submissions to 1,500+ data broker sites
Real-time tracking of every request from submission to confirmation
Automatic follow-up on non-responsive brokers
Continuous monitoring for re-listings with recurring scans
CCPA enforcement for enterprise data brokers that ignore requests

Start your free scan to see where your data is exposed and let our pipeline handle the rest.

Frequently Asked Questions

How long does the average data broker take to remove your information?

Based on our analysis of 1,500+ removal requests, the median time from submission to confirmed removal is approximately 12 days. However, this varies dramatically by broker category. People-search sites average 5 to 10 days, while enterprise data brokers frequently take 30 to 45 days. Some brokers never respond at all.

What happens when a data broker ignores your removal request?

Approximately 5% of removal requests receive no response within 60 days. In states with privacy laws like CCPA, you can file a complaint with the state attorney general. California residents may also have limited private right of action under certain conditions. Automated services like GhostMyData escalate non-responsive brokers and resubmit requests, which significantly improves eventual compliance rates.

Do data brokers process removal requests faster in states with privacy laws?

Yes, but the effect is modest. Brokers operating in states with comprehensive privacy laws (California, Colorado, Virginia, Connecticut) tend to respond 10 to 20% faster than the same brokers respond to residents of states without privacy legislation. The legal deadline creates urgency, but enforcement gaps mean many brokers still push the boundaries of compliance.

Why does my data reappear after a successful removal?

Most data brokers continuously ingest new records from public records databases, marketing partners, and other data sources. When they process a new batch of records containing your information, they often re-create your profile even though you previously opted out. This is why one-time removal is not sufficient — ongoing monitoring and repeated removal requests are necessary to maintain your privacy.

Can I speed up a slow data broker removal?

A follow-up communication citing the specific state privacy law and its response deadline can accelerate stalled requests. Reference the statute by name (e.g., "California Consumer Privacy Act Section 1798.105") and include your original request date. Our data shows that brokers that receive a follow-up within 30 days of the original request complete the removal approximately 40% faster than those that do not receive follow-up.

Data Broker Response Times: Real Data from 1,500+ Removal Requests