Nineteen-plus states have now passed comprehensive privacy laws, and the deletion right is spreading fast — but what those laws actually do for the person trying to get their address off the internet is widely misunderstood. This guide covers the eleven states where the picture is most developed, what each one really gives you, and the loophole they nearly all share. Every claim traces to the statute, the state attorney general, or the enacting bill, verified on the date above.
The loophole to understand first
Every comprehensive state privacy law excludes “publicly available information” from its definition of personal data — government records (property deeds, court files, voter rolls) and information lawfully made public. People-search listings are assembled largely from exactly those records. So the blunt truth: a statutory deletion request usually cannot force a people-search site to drop a listing built from public records.
That does not make the laws useless — far from it. They cover the data brokers’ other holdings (purchased marketing data, inferences, contact details from commercial sources), they back the browser-level opt-out signal, and four states force brokers onto public registries. But the practical removal path for the listings a stranger finds when they Google you remains the sites’ own opt-out processes — all free, all covered in our 18 step-by-step guides — with one giant exception: California’s DROP, which targets registered brokers as a category rather than arguing about data definitions (full DROP guide). Vermont’s 2026 broker law takes the same approach and has no public-records escape hatch at all.
The map, in one table
| State | Law (effective) | Delete right | Response | Honors GPC signal | Broker registry |
|---|---|---|---|---|---|
| California | CCPA/CPRA + Delete Act | Yes, plus DROP one-shot | 45d | Yes | Yes — 600+ brokers |
| Virginia | VCDPA (Jan 2023) | Yes | 45d +45 | No | No |
| Colorado | CPA (Jul 2023) | Yes | 45d +45 | Yes (Jul 2024) | No |
| Connecticut | CTDPA (Jul 2023; expanded Jul 2026) | Yes — incl. third-party-sourced data | 45d +45 | Yes (Jan 2025) | No |
| Texas | TDPSA (Jul 2024) | Yes | 45d +45 | Yes (Jan 2025) | Yes — SOS registry |
| Oregon | OCPA (Jul 2024) | Yes | 45d +45 | Yes (Jan 2026) | Yes — DFR registry |
| Delaware | DPDPA (Jan 2025) | Yes — incl. data obtained about you | 45d +45 | Yes (Jan 2026) | No |
| New Jersey | NJDPA (Jan 2025) | Yes | 45d +45 | Yes (Jul 2025) | No |
| Minnesota | MCDPA (Jul 2025) | Yes | 45d +45 | Yes (Jul 2025) | No |
| Washington | My Health My Data (2024) | Health data only | 45d +45 | No | No |
| Vermont | Broker law (2019; amended 2026) | Broker deletion from Jan 1, 2027 | 30d | No | Yes — the original (2018) |
State notes worth knowing
California remains the strongest hand: the general CCPA deletion right plus the Delete Act’s DROP platform, which turns one request into a deletion order against every registered broker. If you live in California, start there.
Texas covers almost every business — there is no consumer-count threshold, only an SBA-small-business carve-out — and its Secretary of State broker registry requires registrants to label themselves as data brokers on their own sites. Refused requests can be appealed (60-day decision) and then escalated to the AG’s dedicated privacy complaint form.
Connecticut got materially stronger this month: from July 1, 2026, the law reaches any business that offers personal data for sale at all, regardless of size — the prong that squarely covers people-search operators — and its deletion right explicitly includes data collected from third parties.
Oregon pairs its deletion right with a broker registry (searchable via the state’s license lookup), and its exemptions are data-level rather than entity-level — narrower shelter for brokers than in Virginia or Texas. The Oregon DOJ’s own enforcement reports note deletion is the most-denied right, so use the appeal lane.
Vermont deserves more attention than it gets. Its 2018 registry (~283 brokers, searchable) defines brokers by not having a relationship with you — no public-records loophole — and the 2026 amendments (Act 138) add a mandatory deletion-request page on every registered broker with a 30-day processing deadline from January 1, 2027, backed by a $20,000 bond and steep daily penalties. A centralized California-style one-stop portal was studied instead of built; the feasibility report is due in 2028.
Washington has no comprehensive law — its 2026 attempt died in committee — but My Health My Data gives an unusually fierce deletion right for anything touching health data, reaching even backups, with a private right to sue.
Virginia, Colorado, Delaware, New Jersey, Minnesota follow the same 45-day template with appeal rights; Delaware and Connecticut are notable for explicitly covering data obtained about you (broker-sourced), and New Jersey narrows the public-records carve-out slightly — data you restricted to a specific audience never counts as “public.”
How to actually use these rights
- Turn on Global Privacy Control in your browser today if you live in CO, TX, CT, NJ, MN, OR, or DE — one setting, honored by every covered business you visit.
- For people-search listings, use the sites’ own opt-outs first — faster than statutory requests and available to residents of any state: start with the free guide library or see your exposure in 60 seconds.
- For stubborn brokers, invoke the statute in writing — name the law, request deletion of all personal data including data obtained from third parties, and note the 45-day clock. A refusal must come with appeal instructions; a denied appeal must point you to the AG.
- Californians: file DROP. One request, 600+ brokers. The full walkthrough.
- Or make it someone else’s job. Sentinel files removals with the right legal basis per state and hands you receipts; our independent rankings cover the subscription services.
Primary sources: state statutes and AG guidance — Tex. HB 4 & SB 2105; Colo. SB 21-190 and coag.gov; Conn. PA 22-15 as amended by PA 25-113; Va. Code §59.1-575 et seq.; Ore. SB 619 & HB 2052 and doj.state.or.us; 6 Del. C. ch. 12D; N.J. P.L. 2023 c.266 and the NJ AG FAQ; Minn. Stat. ch. 325M; RCW 19.373; 9 V.S.A. §2446 and Vt. Act 138 (2026). Accessed 2026-07-07.