Tag Archives: how to opt out of data sharing

Last Updated: November 6, 2026

Table of Contents

• Know Which Privacy Rights Apply to You in 2026
  • State Privacy Laws in Effect This Year
  • Federal Privacy Legislation and What It Means for You
• The Rights You Can Actually Enforce: Access, Correct, Delete, and Opt Out
• Use a Privacy Rights Request Template That Gets Answered
• How to Request Deletion of Personal Data Step by Step
• How to Opt Out of Data Sharing and Targeted Advertising
• How to Remove Personal Information From the Internet
• When a Company Ignores or Denies Your Request: Appeals and Complaints
• Start With One Request Today
• Frequently Asked Questions

Know Which Privacy Rights Apply to You in 2026

Twenty states have comprehensive privacy laws in effect in 2026, according to Multistate’s 2026 state privacy law tracker. That number matters because knowing how to assert privacy rights online in 2026 starts with one question: which law covers you? At Texas Journal, we track these state-by-state shifts because the answer changes what you can demand, from whom, and how fast.

The short version: your rights depend on where you live, not where the company sits. A California resident can demand deletion from a company in New York. A Texas resident may have different tools under a different statute.

Here is what to check before you send anything:

• Your state’s current privacy statute and its effective date
• Whether the law covers the type of business you’re dealing with
• Whether you qualify as a consumer under that law’s definitions
• Which rights the statute actually grants: access, correction, deletion, or opt-out

Get this wrong and your request gets rejected on eligibility, not merit.

State Privacy Laws in Effect This Year

State-level protections are expanding fast. Multistate counts twenty laws in effect for 2026, with Indiana, Kentucky, and Rhode Island joining the landscape. The BSA’s 2026 state privacy legislation models puts the enacted total at twenty-four.

For filing a request, the effective date of a law is what matters.

Watch out: a law that passed but hasn’t taken effect yet gives you nothing to enforce today. Check the effective date before you cite a statute in a request.

Federal Privacy Legislation and What It Means for You

No comprehensive federal privacy law is in force at the time of writing, and enforcement has largely remained state by state.

That means your enforcement path runs through state law and federal agencies with narrower reach. The Federal Trade Commission can act on deceptive or unfair data practices, but it does not process individual access requests for you.

So don’t wait on Washington. File under your state law, and file now.

The Rights You Can Actually Enforce: Access, Correct, Delete, and Opt Out

Four core rights show up across most state privacy laws. The right to know lets you request what data a company holds and how it shares it. The right to correct covers inaccurate personal information. The right to delete requires erasure in many circumstances. The right to opt out targets data sale, targeted advertising, and some profiling.

Each right has limits. Companies can deny requests that fall under statutory exceptions, and they can require identity verification before acting.

Data protection isn’t automatic. You have to ask, in writing, and often through a specific channel the company designates in its privacy notice.

Use a Privacy Rights Request Template That Gets Answered

A privacy rights request template works because it removes the company’s easiest excuse: an unclear or incomplete ask. Use this structure:

Subject: Consumer Privacy Request, [Right Requested]

To the Privacy Officer:

I am a resident of [State], and I am submitting this request under [Statute Name, Section]. I request:

1. A copy of all personal information you hold about me
2. The categories of sources and third parties you shared it with
3. [Deletion / Correction / Opt-out] of that information

Identify me by: [email/account number/mailing address].

Please confirm receipt within the timeframe your privacy notice states and respond by the statutory deadline. If you deny any part of this request, state the legal basis and your appeal process.

[Full name, address, date]

Keep a copy. Send it through the company’s stated privacy channel, not a general support inbox. A common mistake is emailing customer service, where requests get closed without ever reaching the privacy team.

How to Request Deletion of Personal Data Step by Step

Learning how to request deletion of personal data is mostly about process discipline, but the process is not identical everywhere. The steps below show how major state statutes work, with the deadlines and citations you need to hold a company to its obligations.

Step 1: Confirm you are covered. Deletion rights under comprehensive state laws generally apply to residents of the enacting state acting in an individual or household capacity, not to someone acting for a business. Check your state statute’s definition of “consumer” before you cite it.

Step 2: Find the company’s designated request method. Most statutes require businesses to provide at least two request submission methods, and many require a specific mechanism, such as a webform, a dedicated email address, or a toll-free number. The privacy notice is where the company must disclose this. Use the disclosed channel. A request sent to a general support inbox may not count as a valid request under the statute.

Step 3: Submit a written request that maps to the statute. Name the right you are exercising (deletion), cite the statute and section, identify yourself, and state the personal information you want deleted. If you are also requesting access or correction, say so in the same request; most statutes allow a single verified request to cover multiple rights.

Step 4: Complete identity verification. This is where most requests stall. Statutes permit businesses to take reasonable steps to verify identity, and the standard scales with the sensitivity of the data. To delete sensitive information, a company may ask for government ID or a signed declaration. Respond promptly and use the method the company specifies. If verification fails, the company must generally tell you and explain why.

Step 5: Log the date and the statutory clock. Response deadlines vary by state and are set by each statute, so check the timeframe in your state’s law. Put the deadline on your calendar the day you submit.

Step 6: Follow up in writing if the deadline passes. A short, dated follow-up that references your original request, the submission date, and the statutory deadline creates a record. If the company still does not respond, you now have the documentation you need for an appeal or a regulator complaint.

Make a Difference Today →

Step 7: Read the denial carefully and appeal. If the company denies deletion, the statute usually requires it to state the legal basis. Common exceptions include records needed to complete a transaction, detect fraud or security incidents, comply with legal obligations, exercise free speech, or maintain internal records consistent with your expectations. Some states, including California and Colorado, require an appeal process, and the company must tell you how to use it.

Watch out: deletion is not absolute. Statutes contain exceptions, and a request that ignores them invites a denial.

A common pattern is that requests succeed when they are narrow, cited, and sent through the disclosed channel, and fail when they are broad, uncited, and sent to customer service. Treat the seven steps as a checklist, not a script, and keep every confirmation.

Here is the seven-step deletion process the article lays out, with what each step requires.

Step	What to do	Key detail
1	Confirm you are covered	Resident acting in individual or household capacity
2	Find the designated request method	Use the channel disclosed in the privacy notice
3	Submit a written request	Name the right, cite the statute and section
4	Complete identity verification	Standard scales with data sensitivity
5	Log the date and statutory clock	Put the deadline on your calendar
6	Follow up in writing	Reference original request, date, and deadline
7	Read the denial and appeal	Company must state the legal basis

How to Opt Out of Data Sharing and Targeted Advertising

Opting out of data sharing is often the fastest right to exercise. Many state laws call for a clear opt-out link, often labeled “Do Not Sell or Share My Personal Information.”

Look for these controls:

• The opt-out link in the site footer or privacy notice
• A universal opt-out signal setting in your browser
• Ad settings inside each platform account
• Consent dashboards for apps and connected devices

Targeted advertising and profiling are the main targets. Opt-out requests generally don’t require identity verification, so they move faster than deletion requests.

Research on the privacy paradox shows people often care about online privacy but don’t act on it, according to research published in ScienceDirect. Setting a universal opt-out signal once closes that gap for every site that honors it.

How to Remove Personal Information From the Internet

Removing personal information from the internet means targeting two different places: data brokers and the open web.

For data brokers, submit opt-out requests directly through each company’s process. Many require identity verification, and some re-list your data later, so calendar a recheck.

For the open web, start with search results. Most search engines offer removal tools for sensitive information, and you can request removal of outdated pages directly from site owners.

A practical order of operations:

• Set a universal opt-out signal in your browser
• Submit opt-outs to the largest data brokers first
• Request removal from sites that publish your address or phone number
• Recheck every 90 days

Data breach notification laws in all 50 states and D.C. also shape what companies owe you when your data leaks, per the Privacy Rights Clearinghouse 50-state breach survey.

When a Company Ignores or Denies Your Request: Appeals and Complaints

An ignored request is not a dead end, but the path forward depends on which state’s law applies and what the company actually did. Work through the sequence below in order; each step creates the record the next step depends on.

First, distinguish silence from denial. A missed deadline is a violation you can document. A written denial with a stated legal basis is a decision you can appeal. Treat them differently. If the company has not responded by the statutory deadline, send a dated follow-up that restates the original submission date, the statutory response period, and the fact that the deadline has passed. Keep the follow-up short and factual.

Second, use the appeal process the statute requires. Several comprehensive state laws, California’s CCPA/CPRA and Colorado’s Privacy Act, among them, require businesses to establish an appeal process for denied requests. The company must tell you how to appeal and must respond to the appeal within the period set by the statute. If your state law provides an appeal, use it before going to a regulator; regulators often ask whether you exhausted the company’s process.

Third, escalate to the right regulator. The enforcement landscape is split:

• State attorneys general enforce the most comprehensive state privacy laws, including in California, Colorado, Connecticut, Virginia, Texas, and Oregon. File through the consumer complaint portal on your state’s attorney general’s website.
• Some states have dedicated privacy agencies. California’s Privacy Protection Agency enforces the CCPA and accepts consumer complaints directly.
• The Federal Trade Commission can act on deceptive or unfair data practices under Section 5 of the FTC Act, but it does not adjudicate individual access or deletion requests. A complaint to the FTC is useful when a company’s privacy notice misrepresents what it does with data.

Fourth, understand when a private lawsuit is available. Most comprehensive state laws do not create a general private right of action for privacy violations. California is the notable exception for data breaches: the CCPA gives consumers a private right of action when certain categories of personal information are breached due to a business’s failure to maintain reasonable security. Outside that narrow window, enforcement usually runs through regulators, not courts.

Fifth, document everything. A complaint is only as strong as its paper trail. Keep:

• A copy of the original request and the date and channel of submission
• Any confirmation number or auto-reply
• The company’s verification requests and your responses
• The denial letter and the stated legal basis
• Your appeal and the company’s appeal response
• A dated log of every follow-up

Watch out: filing a regulator complaint before you have used the company’s appeal process can get your complaint closed for failure to exhaust available remedies, so check the appeal requirement in your state statute first.

If you want the broader legal framework behind the rights you are enforcing, our article on asserting your constitutional rights walks through it, and our guide on how to file a civil rights complaint against government covers the mechanics of formal complaints. Documentation matters even when you never end up in court.

Start With One Request Today

You don’t need a lawyer to start. Pick one company holding your data, send one well-built request, and log the deadline. That single action teaches you more about your privacy rights than any overview.

Texas Journal is built around citizens who know the Constitution gives them tools and use them. Our resources show you how to apply that, including Personal Sovereignty Is Non-Negotiable, the principle that your data belongs to you.

Get started with Texas Journal and turn one request into a habit of defending your personal sovereignty.

Dave
Questions? Call!
940-353-1398

Frequently Asked Questions

How long does a company have to respond to a privacy request?

Deadlines depend on your state law. Each state’s privacy law sets response deadlines, so check the timeframe in your statute. The company must tell you if it extends the deadline. If the response window passes with no answer, send a written follow-up citing the deadline, then file a complaint with your state attorney general’s consumer protection division.

What should I include in a data access or deletion request?

Include your full legal name, the email addresses and accounts tied to the company, and a clear statement of what you want (a copy of your data, correction, or deletion). Reference the specific state privacy law that gives you the right. Ask for written confirmation when the action is complete. A privacy rights request template with these fields saves time and reduces back-and-forth on identity verification, which companies may require before acting.

How do I opt out of data sharing if I do not live in a state with a privacy law?

You can still act. Use the company’s own privacy notice to find its opt-out or do-not-sell link, which many businesses offer nationwide regardless of state law. Set a universal opt-out signal in your browser where supported, and submit removal requests to major data brokers directly. Credit reporting bureaus also accept opt-out requests under federal law. State-level rights vary, so check your state attorney general’s website for the rules that apply to you.

Can I remove my personal information from the internet permanently?

Not permanently, but you can shrink your exposure. Submit removal requests to data brokers and people-search sites, delete unused accounts, and tighten social media visibility settings. Removed data can reappear when brokers refresh their databases, so repeat removals every few months. Under federal law, you can also request that credit reporting bureaus remove inaccurate information, and you can place a free credit freeze to limit new account fraud.

---

Your data is yours, and the law backs you up. But rights only work when someone exercises them. Join Texas Journal, use our constitutional guidance and the Patriot Pool to act with others, and stop waiting for Washington to protect what’s already yours. Click Here to get started.